http.cookies.BaseCookie.load() applies partial state before raising CookieError

[tonghuaroot]

Bug description

BaseCookie.load() parses the cookie string in two phases: parse then apply. The comment says it rejects the string if syntactically invalid. However, _is_legal_key() validation runs during the apply phase (inside Morsel.set()), not the parse phase. Cookies before an illegal key are applied to the jar before CookieError is raised.

from http.cookies import SimpleCookie, CookieError

C = SimpleCookie()
try:
    C.load("a=1; b,c=2; d=3")
except CookieError:
    pass
print(len(C))  # 1, expected 0

Related to gh-84183 but distinct: that issue is about raise-vs-silent for different invalid inputs; this is about partial state when CookieError IS raised.

CPython versions tested on

3.13, 3.14, main

Operating systems tested on

macOS

Linked PRs

• gh-154546: Make http.cookies.BaseCookie.load() atomic on error #154674

[picnixz]

What do the docs say? do they say that a partial load is aupported or not? if so I believe we should not fix this, otherwise we should fix it.

[tonghuaroot]

The docs don't say either way. But there's a comment in the source here that says "We first parse the whole cookie string and reject it if it's syntactically invalid". So the two-phase design was meant to be all-or-nothing. The problem is the key validation runs too late (in the apply phase, not the parse phase), so some cookies get applied before the error. Happy to just add a docs note instead if you'd rather keep the current behavior.