The quoting works fine for cookie values, but doesn't kick in for 
attributes like Comment. 

>>> c = SimpleCookie()
>>> c['foo'] = u'\N{COPYRIGHT SIGN}'.encode('UTF8')
>>> print str(c)
Set-Cookie: foo="\302\251";
>>> c['foo']['comment'] = u'\N{BIOHAZARD SIGN}'.encode('UTF8')
>>> print str(c)
Set-Cookie: foo="\302\251"; Comment=?;
>>> str(c)
'Set-Cookie: foo="\\302\\251"; Comment=\xe2\x98\xa3;'
>>> 

This patch adds an unicode character, converted to UTF8 as a cookie's
comment and then checks if it is correctly quoted.

This patch properly quotes cookie's comment and successfully passes
test_cookie.py with applied patch.

Thanks, Zan!

All tests pass with both patches applied. Test and fix look correct to me.

Can someone please take a look at this Cookie.py two line patch.

Can we have this committed please, msg82420 says the patches are ok.

Here is a patch for Python 3.

Berker your patch looks good to me.

Convert it to a PR and then merge?

This patch only quotes the Comment attribute, and the rest of the code only quotes attributes if they're of the expected type.  Consider Expires:

>>> from http.cookies import SimpleCookie
>>> c = SimpleCookie()
>>> c['name'] = 'value'
>>> c['name']['comment'] = '\n'
>>> c['name']['expires'] = 123
>>> c.output()
'Set-Cookie: name=value; Comment="\\012"; expires=Fri, 20 Apr 2018 02:03:13 GMT'
>>> c['name']['expires'] = '123; path=.example.invalid'
'Set-Cookie: name=value; Comment="\\012"; expires=123; path=.example.invalid'

Here's the offending line:

https://github.com/python/cpython/blob/b87c1c92fc93c5733cd3d8606ab2301ca6ba208f/Lib/http/cookies.py#L415

Why not quote all attribute values?

>>> from http.cookies import SimpleCookie
>>> c = SimpleCookie()
>>> c['name'] = 'value'
>>> c['name']['comment'] = '\n'
>>> c['name']['expires'] = '123; path=.example.invalid'
'Set-Cookie: name=value; Comment="\\012"; expires=123; path=.example.invalid'

What do you think that the snippet above should return?

    'Set-Cookie: name=value; Comment="\\012"; expires=Fri, 20 Apr 2018 02:03:13 GMT; path=.example.invalid'

or

    'Set-Cookie: name=value; Comment="\\012"; expires=Fri, 20 Apr 2018 02:03:13 GMT; path=".example.invalid"'

or

    'Set-Cookie: name=value; Comment="\\012"; expires=123; path=".example.invalid"'

?

I don't think the path attribute (or all of them) needs to be quoted unconditionally. Looking at https://tools.ietf.org/html/rfc6265#section-4.1.1, it looks like quoting for cookie-value is optional.

Is there a use case or examples from other programming languages you can share with us?

None of the above :-) I'd expect the last one, but with quoting.

You should not be able to set fields in a cookie by injection.

New changeset d5a2377c3d70e4143bcbee4a765b3434e21f683a by Berker Peksag in branch 'master':
bpo-991266: Fix quoting of Comment attribute of SimpleCookie (GH-6555)
https://github.com/python/cpython/commit/d5a2377c3d70e4143bcbee4a765b3434e21f683a

New changeset 9fc998d761591f2741d8e94f5b3009c56ae83882 by Berker Peksag (Miss Islington (bot)) in branch '3.7':
bpo-991266: Fix quoting of Comment attribute of SimpleCookie (GH-6555)
https://github.com/python/cpython/commit/9fc998d761591f2741d8e94f5b3009c56ae83882

New changeset 8a6f4b4bba950fb8eead1b176c58202d773f2f70 by Berker Peksag (Miss Islington (bot)) in branch '3.6':
bpo-991266: Fix quoting of Comment attribute of SimpleCookie (GH-6555)
https://github.com/python/cpython/commit/8a6f4b4bba950fb8eead1b176c58202d773f2f70

I've opened bpo-33535 to discuss Mark Williams' suggestion.