parse cookie expires date as ascii-only

[dxbjavid]

What do these changes do?

cookie Expires values are parsed in CookieJar._parse_date with regexes whose \d classes were compiled without re.ASCII, so \d also matches unicode decimal digits (Arabic-Indic, fullwidth and the like). response header values reach the jar decoded as utf-8, so a server can send an Expires built from non-ascii digits and int() converts them just fine, giving a valid expiry identical to the plain-ascii date.

RFC 6265 5.1.1 defines cookie-date digits as ascii only, and browsers reject such a date and keep the cookie as a session cookie, so today aiohttp can be handed a longer-lived cookie than a compliant client would retain. compiling the date regexes with re.ASCII restricts them to ascii digits, in line with the spec and with how the rest of the parser already treats digits.

Are there changes in behavior for the user?

Expires values that rely on non-ascii digits now fail to parse and clear the attribute, so the cookie becomes a session cookie, the same as any other unparseable date. plain-ascii dates are unchanged.

Is it a substantial burden for the maintainers to support this?

no, it is a flag on the existing date regexes plus a regression test.

Related issue number

N/A

Checklist

• I think the code is well written
• Unit tests for the changes exist
• Documentation reflects the changes — N/A, internal parsing only
• If you provide code modification, please add yourself to CONTRIBUTORS.txt — already present
• Add a new news fragment into the CHANGES/ folder

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.98%. Comparing base (b2b7b50) to head (8a815bd).
⚠️ Report is 8 commits behind head on master.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##           master   #13278   +/-   ##
=======================================
  Coverage   98.98%   98.98%           
=======================================
  Files         132      132           
  Lines       49023    49058   +35     
  Branches     2551     2552    +1     
=======================================
+ Hits        48526    48561   +35     
  Misses        373      373           
  Partials      124      124           

Flag	Coverage Δ
Autobahn	22.13% <50.00%> (+<0.01%)	⬆️
CI-GHA	98.90% <100.00%> (+<0.01%)	⬆️
OS-Linux	98.67% <100.00%> (-0.01%)	⬇️
OS-Windows	97.03% <100.00%> (-0.01%)	⬇️
OS-macOS	97.93% <100.00%> (-0.01%)	⬇️
Py-3.10	98.12% <100.00%> (+<0.01%)	⬆️
Py-3.11	98.37% <100.00%> (+<0.01%)	⬆️
Py-3.12	98.46% <100.00%> (+<0.01%)	⬆️
Py-3.13	98.44% <100.00%> (-0.01%)	⬇️
Py-3.14	98.46% <100.00%> (+<0.01%)	⬆️
Py-3.14t	97.55% <100.00%> (-0.01%)	⬇️
Py-pypy-3.11	97.39% <100.00%> (-0.01%)	⬇️
VM-macos	97.93% <100.00%> (-0.01%)	⬇️
VM-ubuntu	98.67% <100.00%> (-0.01%)	⬇️
VM-windows	97.03% <100.00%> (-0.01%)	⬇️
cython-coverage	37.96% <50.00%> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

[codspeed-hq]

Merging this PR will not alter performance

✅ 84 untouched benchmarks
⏩ 83 skipped benchmarks¹

---

_{Comparing dxbjavid:cookie-date-ascii-digits (8a815bd) with master (537125a)}

Footnotes

1. 83 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

[patchback]

Backport to 3.15: 💚 backport PR created

✅ Backport PR branch: patchback/backports/3.15/d5d068cb541ab7df5ecca14515475f9d4a379c5e/pr-13278

Backported as #13317

🤖 @patchback
I'm built with octomachinery and
my source is open — https://github.com/sanitizers/patchback-github-app.