python · LamentXU123 · Jun 20, 2025 · Jun 20, 2025 · Jun 20, 2025 · Jun 20, 2025
diff --git a/Lib/http/cookiejar.py b/Lib/http/cookiejar.py
@@ -532,15 +532,31 @@ def parse_ns_headers(ns_headers):
     return result
 
 
+# only kept for backwards compatibilty.
 IPV4_RE = re.compile(r"\.\d+$", re.ASCII)
+
+def is_ip_like(text: str):
+    """Return True if text is a valid hostname in the form of IP address."""
+    from ipaddress import IPv4Address, IPv6Address
+    # check for IPv4 address
+    try:
+        IPv4Address(text)
+    except ValueError:
+        # check for IPv6 address in []
+        if text.startswith('[') and text.endswith(']'):
+            try:
+                IPv6Address(text.removeprefix('[').removesuffix(']'))
+            except ValueError:
+                return False
+        else:
+            return False # not a IPv6 address in []
+    return True
 def is_HDN(text):
     """Return True if text is a host domain name."""
     # XXX
     # This may well be wrong.  Which RFC is HDN defined in, if any (for
     #  the purposes of RFC 2965)?
-    # For the current implementation, what about IPv6?  Remember to look
-    #  at other uses of IPV4_RE also, if change this.
-    if IPV4_RE.search(text):
+    if is_ip_like(text):
         return False
     if text == "":
         return False
@@ -593,9 +609,7 @@ def liberal_is_HDN(text):
     For accepting/blocking domains.
 
     """
-    if IPV4_RE.search(text):
-        return False
-    return True
+    return not is_ip_like(text)
 
 def user_domain_match(A, B):
     """For blocking/accepting domains.
@@ -641,7 +655,17 @@ def eff_request_host(request):
 
     """
     erhn = req_host = request_host(request)
-    if "." not in req_host:
+    if req_host.startswith('[') and req_host.endswith(']'):
+        from ipaddress import IPv6Address
+        try:
+            IPv6Address(req_host.removeprefix('[').removesuffix(']'))
+            is_ipV6 = True
+        except ValueError:
+            is_ipV6 = False
+    else:
+        is_ipV6 = False
+    if "." not in req_host and not is_ipV6:
+        # avoid adding .local at the end of a IPV6 address
         erhn = req_host + ".local"
     return req_host, erhn
 

diff --git a/Lib/test/test_http_cookiejar.py b/Lib/test/test_http_cookiejar.py
@@ -16,7 +16,7 @@
      CookieJar, DefaultCookiePolicy, LWPCookieJar, MozillaCookieJar,
      LoadError, lwp_cookie_str, DEFAULT_HTTP_PORT, escape_path,
      reach, is_HDN, domain_match, user_domain_match, request_path,
-     request_port, request_host)
+     request_port, request_host, is_ip_like)
 
 mswindows = (sys.platform == "win32")
 
@@ -860,12 +860,24 @@ def test_is_HDN(self):
         self.assertTrue(is_HDN("foo.bar.com"))
         self.assertTrue(is_HDN("1foo2.3bar4.5com"))
         self.assertFalse(is_HDN("192.168.1.1"))
+        self.assertFalse(is_HDN("[::1]"))
+        self.assertFalse(is_HDN("[2001:db8:85a3::8a2e:370:7334]"))
         self.assertFalse(is_HDN(""))
         self.assertFalse(is_HDN("."))
         self.assertFalse(is_HDN(".foo.bar.com"))
         self.assertFalse(is_HDN("..foo"))
         self.assertFalse(is_HDN("foo."))
 
+    def test_is_ip_like(self):
+        self.assertTrue(is_ip_like('[::1]'))
+        self.assertTrue(is_ip_like('[2001:db8:85a3::8a2e:370:7334]'))
+        self.assertTrue(is_ip_like('192.168.0.1'))
+
+        self.assertFalse(is_ip_like('256.256.256.256'))
+        self.assertFalse(is_ip_like('[::2001:db8:85a3::]'))
+        self.assertFalse(is_ip_like('acme.com'))
+        self.assertFalse(is_ip_like(''))
+
     def test_reach(self):
         self.assertEqual(reach("www.acme.com"), ".acme.com")
         self.assertEqual(reach("acme.com"), "acme.com")
@@ -875,9 +887,16 @@ def test_reach(self):
         self.assertEqual(reach("."), ".")
         self.assertEqual(reach(""), "")
         self.assertEqual(reach("192.168.0.1"), "192.168.0.1")
+        self.assertEqual(reach("[::1]"), "[::1]")
+        self.assertEqual(reach("[2001:db8:85a3::8a2e:370:7334]"),
+                          "[2001:db8:85a3::8a2e:370:7334]")
 
     def test_domain_match(self):
         self.assertTrue(domain_match("192.168.1.1", "192.168.1.1"))
+        self.assertTrue(domain_match("[::1]", "[::1]"))
+        self.assertFalse(domain_match("[::1]", "::1"))
+        self.assertTrue(domain_match("[2001:db8:85a3::8a2e:370:7334]",
+                                      "[2001:db8:85a3::8a2e:370:7334]"))
         self.assertFalse(domain_match("192.168.1.1", ".168.1.1"))
         self.assertTrue(domain_match("x.y.com", "x.Y.com"))
         self.assertTrue(domain_match("x.y.com", ".Y.com"))
@@ -905,8 +924,11 @@ def test_domain_match(self):
         self.assertFalse(user_domain_match("x.y.com", ".m"))
         self.assertFalse(user_domain_match("x.y.com", ""))
         self.assertFalse(user_domain_match("x.y.com", "."))
-        self.assertTrue(user_domain_match("192.168.1.1", "192.168.1.1"))
         # not both HDNs, so must string-compare equal to match
+        self.assertTrue(user_domain_match("192.168.1.1", "192.168.1.1"))
+        self.assertTrue(user_domain_match("[::1]", "[::1]"))
+        self.assertTrue(domain_match("2001:db8::", "2001:db8::"))
+        self.assertFalse(user_domain_match("[::1]", "::1"))
         self.assertFalse(user_domain_match("192.168.1.1", ".168.1.1"))
         self.assertFalse(user_domain_match("192.168.1.1", "."))
         # empty string is a special case
@@ -1168,6 +1190,30 @@ def test_domain_block(self):
         c.add_cookie_header(req)
         self.assertFalse(req.has_header("Cookie"))
 
+    def test_block_ip_domains(self):
+        pol = DefaultCookiePolicy(
+            rfc2965=True, blocked_domains=[])
+        c = CookieJar(policy=pol)
+        headers = ["Set-Cookie: CUSTOMER=WILE_E_COYOTE; path=/"]
+
+        pol.set_blocked_domains(["[::1]"])
+        req = urllib.request.Request("http://[::1]:8080")
+        res = FakeResponse(headers, "http://[::1]:8080")
+        c.extract_cookies(res, req)
+        self.assertEqual(len(c), 0)
+
+        pol.set_blocked_domains(["[2001:db8:85a3::8a2e:370:7334]"])
+        req = urllib.request.Request("http://[2001:db8:85a3::8a2e:370:7334]:8080")
+        res = FakeResponse(headers, "http://[2001:db8:85a3::8a2e:370:7334]:8080")
+        c.extract_cookies(res, req)
+        self.assertEqual(len(c), 0)
+
+        pol.set_blocked_domains([""])
+        req = urllib.request.Request("http://[::1]:8080")
+        res = FakeResponse(headers, "http://[::1]:8080")
+        c.extract_cookies(res, req)
+        self.assertEqual(len(c), 1)
+
     def test_secure(self):
         for ns in True, False:
             for whitespace in " ", "":

diff --git a/Misc/NEWS.d/next/Library/2025-06-20-17-03-51.gh-issue-135768.DhUJWf.rst b/Misc/NEWS.d/next/Library/2025-06-20-17-03-51.gh-issue-135768.DhUJWf.rst
@@ -0,0 +1,2 @@
+:mod:`http.cookiejar`: fix allowed and blocked IPv6 domains
+in :class:`~http.cookiejar.DefaultCookiePolicy`.
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,2 @@
		:mod:`http.cookiejar`: fix allowed and blocked IPv6 domains
		in :class:`~http.cookiejar.DefaultCookiePolicy`.