Patched code sample

import logging
import re
from string import octdigits

# --- A simplified representation of the aiohttp cookie parsing environment ---
# This setup is to make the fix demonstrable and self-contained.

# In the actual aiohttp code, this is `aiohttp.http_cookies.log`
log = logging.getLogger("aiohttp.http_cookies")
logging.basicConfig(level=logging.INFO)

# A representation of the CookieError exception
class CookieError(Exception):
    pass

# A simplified Cookie Morsel to mimic validation
_LegalKeyChars = r"[\w\d!#%&'~_`><@,;/\$\*\+\-\.\^\|\]\)\(\?\}\{\=]"
_is_legal_key = re.compile(_LegalKeyChars).match

class Morsel(dict):
    def set(self, key, real_value, coded_value):
        if not _is_legal_key(key):
            raise CookieError(f"Illegal key value: {key}")
        self[key] = real_value

# This class structure represents the environment where the fix was applied.
# The `aiohttp.http_cookies.SimpleCookie` class is a modified version
# of Python's `http.cookies.SimpleCookie`.
class SimpleCookie(dict):
    def __init__(self, input=None):
        if input:
            self.load(input)

    def __setitem__(self, key, value):
        """Simulate the validation that can raise CookieError."""
        if isinstance(value, str):
            morsel = Morsel()
            # This is a simplified validation from stdlib's http.cookies
            # It will raise CookieError for invalid characters like spaces.
            morsel.set(key, value, value)
            super().__setitem__(key, morsel)
        else:
            super().__setitem__(key, value)

    # --- Start of the Fixed Code from aiohttp 3.13.3 (and 3.9.2) ---
    # The vulnerability was in the `load` method. This is the patched version.

    def load(self, rawdata):
        """
        Load cookies from a string or a dictionary.

        The `load` method is responsible for parsing a string of
        cookies and loading them into the `SimpleCookie` object.
        The vulnerability existed here, where each invalid cookie
        would trigger a separate log warning.

        The fix involves collecting all parsing errors and emitting a
        single, consolidated warning message at the end, thus
prevening
        a "logging storm".
        """
        if isinstance(rawdata, str):
            # This parsing logic is part of the original class and is
            # included here for context. The key change is in the error handling.
            unparsed_cookies = []
            for cookie in rawdata.split(";"):
                cookie = cookie.strip()
                if not cookie:
                    continue
                if "=" not in cookie:
                    unparsed_cookies.append(cookie)
                    continue
                name, value = cookie.split("=", 1)
                try:
                    self[name] = value
                except CookieError:
                    unparsed_cookies.append(f"{name}={value}")

            if unparsed_cookies:
                log.warning(
                    "Could not parse %d cookies: %s",
                    len(unparsed_cookies),
                    ", ".join(unparsed_cookies),
                )
        else:
            # It can also load from a dictionary
            unparsed_cookies = []
            for name, value in rawdata.items():
                try:
                    self[name] = value
                except CookieError:
                    unparsed_cookies.append(f"{name}={value}")

            if unparsed_cookies:
                log.warning(
                    "Could not parse %d cookies: %s",
                    len(unparsed_cookies),
                    ", ".join(unparsed_cookies),
                )

# --- End of the Fixed Code ---


if __name__ == "__main__":
    # A malicious cookie header with many invalid parts.
    # An invalid cookie key (contains a space) is used to trigger CookieError.
    # The vulnerable version would print a separate warning for each of these.
    malicious_cookie_header = (
        "invalid cookie 1=a; "
        "invalid cookie 2=b; "
        "invalid cookie 3=c; "
        "valid_key=good_value; "
        "invalid cookie 4=d; "
        "another_good=one; "
        "invalid cookie 5=e; "
    )

    print("--- Demonstrating the FIX ---")
    print(f"Parsing header: '{malicious_cookie_header}'\n")

    # With the fix, loading these cookies results in a single warning message.
    cookies = SimpleCookie()
    cookies.load(malicious_cookie_header)

    print("\n--- Result ---")
    print("Parsed cookies:", cookies)
    print("\nNotice that only ONE warning was logged for all invalid cookies.")