Skip to content

Fix mutable morsels - #13637

Merged
Dreamsorcerer merged 2 commits into
masterfrom
fix-mutable-morsel
Sep 5, 2026
Merged

Dreamsorcerer merged 2 commits into
masterfrom
fix-mutable-morsel

Conversation

@Dreamsorcerer

@Dreamsorcerer Dreamsorcerer commented Sep 5, 2026

Copy link
Copy Markdown
Member

Fixes #13634

@Dreamsorcerer Dreamsorcerer added the backport-3.15 Trigger automatic backporting to the 3.15 release branch by Patchback robot label Sep 5, 2026
@psf-chronographer psf-chronographer Bot added the bot:chronographer:provided There is a change note present in this PR label Sep 5, 2026
@codecov

codecov Bot commented Sep 5, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.02%. Comparing base (fbc5851) to head (0245bd0).
⚠️ Report is 1 commits behind head on master.
✅ All tests successful. No failed tests found.

Additional details and impacted files
@@            Coverage Diff             @@
##           master   #13637      +/-   ##
==========================================
- Coverage   99.02%   99.02%   -0.01%     
==========================================
  Files         135      135              
  Lines       50818    50845      +27     
  Branches     2671     2674       +3     
==========================================
+ Hits        50325    50351      +26     
  Misses        370      370              
- Partials      123      124       +1     
Flag Coverage Δ
Autobahn 21.97% <19.44%> (-0.01%) ⬇️
CI-GHA 98.92% <100.00%> (-0.01%) ⬇️
OS-Linux 98.69% <100.00%> (-0.01%) ⬇️
OS-Windows 97.31% <100.00%> (-0.01%) ⬇️
OS-macOS 98.18% <100.00%> (-0.01%) ⬇️
Py-3.10 98.12% <100.00%> (-0.01%) ⬇️
Py-3.11 98.35% <100.00%> (-0.01%) ⬇️
Py-3.12 98.43% <100.00%> (-0.01%) ⬇️
Py-3.13 98.42% <100.00%> (-0.01%) ⬇️
Py-3.14 98.45% <100.00%> (+<0.01%) ⬆️
Py-3.14t 97.83% <100.00%> (+<0.01%) ⬆️
Py-pypy-3.11 97.38% <100.00%> (-0.03%) ⬇️
VM-macos 98.18% <100.00%> (-0.01%) ⬇️
VM-ubuntu 98.69% <100.00%> (-0.01%) ⬇️
VM-windows 97.31% <100.00%> (-0.01%) ⬇️
cython-coverage 83.15% <90.00%> (-0.01%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

@greptile-apps

greptile-apps Bot commented Sep 5, 2026

Copy link
Copy Markdown

Confidence Score: 5/5

Safe to merge based on direct ownership-isolation checks, real HTTP cookie delivery, and focused regression coverage.

The focused checks reproduced the previous mutable-object behavior on the base revision and confirmed the corrected behavior on this revision, including raw-header cookie handling and abstract/concrete cookie-jar compatibility.

Files Needing Attention: No files need further attention; aiohttp/cookiejar.py and tests/test_cookiejar.py were exercised directly.

T-Rex T-Rex Logs

What T-Rex did

    • Ran the authored CookieJar end-to-end validation script against base fbc5851 and HEAD, then ran the selected CookieJar regression tests.
    • On the base revision, the caller Morsel had domain set to example.test and path /sub, and mutating that Morsel later changed the stored sid to attacker-controlled; on HEAD, the caller attributes remained blank and the stored sid stayed original, while raw Set-Cookie headers were normalized to localhost:/app and localhost:/api and delivered only to matching paths.
    • The upstream CookieJar tests ran and completed 12 tests successfully on HEAD.
    • Artifact uploads were validated and all listed files are present for review.

View all artifacts

T-Rex Ran code and verified through T-Rex

Reviews (1): Last reviewed commit: "Rename 13634.bugfix.rst to 13637.bugfix...." | Re-trigger Greptile

@codspeed

codspeed Bot commented Sep 5, 2026

Copy link
Copy Markdown

Merging this PR will not alter performance

✅ 97 untouched benchmarks
⏩ 83 skipped benchmarks1


Comparing fix-mutable-morsel (0245bd0) with master (fbc5851)

Open in CodSpeed

Footnotes

  1. 83 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports.

@Dreamsorcerer
Dreamsorcerer merged commit 1857e6d into master Sep 5, 2026
52 of 53 checks passed
@Dreamsorcerer
Dreamsorcerer deleted the fix-mutable-morsel branch September 5, 2026 01:53
@patchback

patchback Bot commented Sep 5, 2026

Copy link
Copy Markdown
Contributor

Backport to 3.15: 💔 cherry-picking failed — conflicts found

❌ Failed to cleanly apply 1857e6d on top of patchback/backports/3.15/1857e6df6e9efce10dcf08a4ee26a366add2e443/pr-13637

Backporting merged PR #13637 into master

  1. Ensure you have a local repo clone of your fork. Unless you cloned it
    from the upstream, this would be your origin remote.
  2. Make sure you have an upstream repo added as a remote too. In these
    instructions you'll refer to it by the name upstream. If you don't
    have it, here's how you can add it:
    git remote add upstream https://github.com/aio-libs/aiohttp.git
    
  3. Ensure you have the latest copy of upstream and prepare a branch
    that will hold the backported code:
    git fetch upstream
    git checkout -b patchback/backports/3.15/1857e6df6e9efce10dcf08a4ee26a366add2e443/pr-13637 upstream/3.15
    
  4. Now, cherry-pick PR Fix mutable morsels #13637 contents into that branch:
    git cherry-pick -x 1857e6df6e9efce10dcf08a4ee26a366add2e443
    
    If it'll yell at you with something like fatal: Commit 1857e6df6e9efce10dcf08a4ee26a366add2e443 is a merge but no -m option was given., add -m 1 as follows instead:
    git cherry-pick -m1 -x 1857e6df6e9efce10dcf08a4ee26a366add2e443
    
  5. At this point, you'll encounter some merge conflicts. You must
    resolve them in order to preserve the patch from PR Fix mutable morsels #13637 as close to the
    original as possible.
  6. Once conflicts are resolved and git added, run:
    git cherry-pick --continue
    
  7. Push this branch to your fork on GitHub:
    git push origin patchback/backports/3.15/1857e6df6e9efce10dcf08a4ee26a366add2e443/pr-13637
    
  8. Create a PR, ensure that the CI is green. If it's not — update it so that
    the tests and any other checks pass. This is it!
    Now relax and wait for the maintainers to process your pull request
    when they have some cycles to do reviews. Don't worry — they'll tell you if
    any improvements are necessary when the time comes!

🤖 @patchback
I'm built with octomachinery and
my source is open — https://github.com/sanitizers/patchback-github-app.

Dreamsorcerer added a commit that referenced this pull request Sep 5, 2026
(cherry picked from commit 1857e6d)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport-3.15 Trigger automatic backporting to the 3.15 release branch by Patchback robot bot:chronographer:provided There is a change note present in this PR

Projects

None yet

Development

Successfully merging this pull request may close these issues.

CookieJar.update_cookies() aliases a caller-supplied Morsel instead of copying it

1 participant