gh-99453: improve entries validation of Netscape/Mozilla cookie files

Lib/http/cookiejar.py

@@ -2037,8 +2037,13 @@ def _really_load(self, f, filename, ignore_discard, ignore_expires):
                     line.strip() == ""):
                     continue
 
-                domain, domain_specified, path, secure, expires, name, value = \
-                        line.split("\t")
+                fields = line.split("\t")
+                if len(fields) != 7:
+                    raise LoadError(
+                        "invalid fields in Netscape format cookies file %r: %r"
+                        % (filename, line)
+                    )
+                domain, domain_specified, path, secure, expires, name, value = fields
                 secure = (secure == "TRUE")
                 domain_specified = (domain_specified == "TRUE")
                 if name == "":

Lib/test/test_http_cookiejar.py

@@ -2023,6 +2023,17 @@ def test_session_cookies(self):
             # we didn't have session cookies in the first place
         self.assertNotEqual(counter["session_before"], 0)
 
+    def test_mozilla_cookiejar_loaderror_on_malformed_file(self):
+        # Malformed cookie file should raise LoadError
+        filename = os_helper.TESTFN
+        with open(filename, "w") as f:
+            f.write("# Netscape HTTP Cookie File\n")
+            f.write("malformed line\n")
+        self.addCleanup(os_helper.unlink, filename)
+        jar = MozillaCookieJar(filename)
+        err = "invalid fields in Netscape format cookies file"
+        self.assertRaisesRegex(LoadError, err, jar.load)
+
 
 if __name__ == "__main__":
     unittest.main()

Misc/ACKS

@@ -1538,6 +1538,7 @@ Dhushyanth Ramasamy
 Ashwin Ramaswami
 Jeff Ramnani
 Grant Ramsay
+Paul Ramshaw
 Bayard Randel
 Varpu Rantala
 Brodie Rao

Misc/NEWS.d/next/Library/2025-09-28-12-52-40.gh-issue-99453.qJBIf-.rst

@@ -0,0 +1,4 @@
+:mod:`http.cookiejar`: loading malformed Netscape/Mozilla cookie files
+by :meth:`MozillaCookieJar.load <http.cookiejar.FileCookieJar.load>`
+now raise a :exc:`~http.cookiejar.LoadError` instead of an uncaught
+:exc:`ValueError`.