Skip to content

fix: Fix panic on a malformed server cookie - #491

Merged
Pijukatel merged 5 commits into
masterfrom
claude/malformed-cookie-handling-mhdccv
Jul 1, 2026
Merged

fix: Fix panic on a malformed server cookie#491
Pijukatel merged 5 commits into
masterfrom
claude/malformed-cookie-handling-mhdccv

Conversation

@Pijukatel

Copy link
Copy Markdown
Contributor

Malformed cookies are silently ignored like in JS version.

claude and others added 4 commits June 29, 2026 11:38
`set_cookies` runs inside reqwest's cookie-store callback, a Rust callback
driven by the HTTP stack. The `.unwrap()`s on the cookie constructor and
`set_cookie` call meant a hostile/buggy server's malformed `Set-Cookie`
(bad domain/expiry that `http.cookiejar.Cookie` rejects), or a custom cookie
jar whose `set_cookie` raises, would panic and unwind across the FFI
boundary — aborting the host process instead of raising a catchable
exception.

Mirror the Node wrapper's behavior of skipping cookies the jar rejects, but
emit a Python `UserWarning` (falling back to stderr) so the dropped cookie
is surfaced rather than silently ignored.

Closes #478

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015p2biLkkRLNEs9xWyqdpby
`set_cookies` runs inside reqwest's cookie-store callback, a Rust callback
driven by the HTTP stack. The `.unwrap()`s on the cookie constructor and
`set_cookie` call meant a hostile/buggy server's malformed `Set-Cookie`
(bad domain/expiry that `http.cookiejar.Cookie` rejects), or a custom cookie
jar whose `set_cookie` raises, would panic and unwind across the FFI
boundary — aborting the host process instead of raising a catchable
exception.

Skip the offending cookie and continue, ignoring parsing errors silently to
match the Node binding's `setCookie` handling in `index.wrapper.js`.

Closes #478

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015p2biLkkRLNEs9xWyqdpby
Add a regression test (sync and async) for #478: a custom cookie jar whose
`set_cookie` raises must not abort the interpreter. The request completes,
the offending cookie is skipped, and a valid cookie in the same response is
still stored.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015p2biLkkRLNEs9xWyqdpby
@Pijukatel
Pijukatel force-pushed the claude/malformed-cookie-handling-mhdccv branch from 32d1ee1 to fbb575f Compare June 30, 2026 11:02
@Pijukatel
Pijukatel marked this pull request as ready for review June 30, 2026 11:32
@Pijukatel
Pijukatel requested a review from Copilot June 30, 2026 11:32

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR prevents the Python bindings from panicking when encountering malformed server Set-Cookie headers (or cookie-jar rejections), aligning behavior with the JS implementation by silently skipping problematic cookies.

Changes:

  • Update PythonCookieJar::set_cookies to stop unwrapping Python cookie construction / insertion and instead skip on errors.
  • Add sync + async regression tests ensuring a rejecting CookieJar doesn’t crash the client and still stores valid cookies.
  • Update the Python lockfile version for impit.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 3 comments.

File Description
impit-python/src/cookies.rs Avoid panics by skipping cookies that fail Python construction or insertion into the provided cookie jar.
impit-python/test/basic_client_test.py Add regression test covering rejected cookie handling in the sync client.
impit-python/test/async_client_test.py Add regression test covering rejected cookie handling in the async client.
impit-python/uv.lock Bump the locked impit package version.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread impit-python/src/cookies.rs Outdated
Comment thread impit-python/test/basic_client_test.py Outdated
Comment thread impit-python/test/async_client_test.py Outdated
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
@Pijukatel
Pijukatel requested a review from barjin June 30, 2026 11:45

@barjin barjin left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm, thank you @Pijukatel !

@Pijukatel
Pijukatel merged commit a6af0f0 into master Jul 1, 2026
27 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

(py) set_cookies() .unwrap() panics across FFI on a malformed server Set-Cookie

5 participants