gh-154546: Make http.cookies.BaseCookie.load() atomic on error

Lib/http/cookies.py

@@ -624,7 +624,11 @@ def __parse_string(self, str, patt=_CookiePattern):
                 # Invalid cookie string
                 return
 
-        # The cookie string is valid, apply it.
+        # The cookie string parsed cleanly.  Build the morsels in a temporary
+        # mapping and only mutate self once every key and attribute has been
+        # validated, so that an illegal key or attribute later in the string
+        # cannot leave the cookie jar partially updated (gh-154546).
+        built = {}       # key -> Morsel, staged until the whole string is valid
         M = None         # current morsel
         for tp, key, value in parsed_items:
             if tp == TYPE_ATTRIBUTE:
@@ -633,8 +637,18 @@ def __parse_string(self, str, patt=_CookiePattern):
             else:
                 assert tp == TYPE_KEYVALUE
                 rval, cval = value
-                self.__set(key, rval, cval)
-                M = self[key]
+                if key in built:
+                    M = built[key]
+                elif key in self:
+                    # Preserve attributes already set on an existing morsel,
+                    # but work on a copy so self stays untouched until commit.
+                    M = self[key].copy()
+                else:
+                    M = Morsel()
+                M.set(key, rval, cval)
+                built[key] = M
+        for key, M in built.items():
+            dict.__setitem__(self, key, M)
 
 
 class SimpleCookie(BaseCookie):

Lib/test/test_http_cookies.py

@@ -320,6 +320,34 @@ def test_illegal_chars(self):
         with self.assertRaises(cookies.CookieError):
             C.load(rawdata)
 
+    def test_load_does_not_apply_partial_state_on_error(self):
+        # BaseCookie.load() is all-or-nothing: if the raw string contains an
+        # illegal key or attribute that raises CookieError, none of the
+        # cookies from that string are applied to the jar (gh-154546).
+        for rawdata in (
+            "a=1; b,c=2; d=3",     # illegal key in the middle
+            "good=1; bad,key=2",   # illegal key at the end
+            "a=1; $foo=2",         # unknown $-prefixed attribute
+        ):
+            with self.subTest(rawdata=rawdata):
+                C = cookies.SimpleCookie()
+                with self.assertRaises(cookies.CookieError):
+                    C.load(rawdata)
+                self.assertEqual(dict(C), {})
+                self.assertEqual(C.output(), '')
+
+    def test_load_error_leaves_existing_cookies_untouched(self):
+        # A load() that raises CookieError must not mutate cookies that were
+        # already present in the jar (gh-154546).
+        C = cookies.SimpleCookie()
+        C['existing'] = 'kept'
+        C['existing']['path'] = '/here'
+        with self.assertRaises(cookies.CookieError):
+            C.load("new=1; bad,key=2")
+        self.assertEqual(list(C), ['existing'])
+        self.assertEqual(C['existing'].value, 'kept')
+        self.assertEqual(C['existing']['path'], '/here')
+
     def test_comment_quoting(self):
         c = cookies.SimpleCookie()
         c['foo'] = '\N{COPYRIGHT SIGN}'

Misc/NEWS.d/next/Library/2026-07-25-12-00-00.gh-issue-154546.bK9xQ2.rst

@@ -0,0 +1,4 @@
+:meth:`http.cookies.BaseCookie.load` is now atomic: if the cookie string
+contains an illegal key or attribute that raises
+:exc:`~http.cookies.CookieError`, the cookie jar is left unchanged instead of
+being partially updated with the cookies that preceded the error.