CookieJar - return 'best-match' and not LIFO

CHANGES/7577.bugfix

@@ -0,0 +1 @@
+Fix filter_cookies return 'best-mach' (instead of lifo) cookie -- by :user:`marq24`.

CONTRIBUTORS.txt

@@ -228,6 +228,7 @@ Martin Richard
 Mathias Fröjdman
 Mathieu Dugré
 Matt VanEseltine
+Matthias Marquardt
 Matthieu Hauglustaine
 Matthieu Rigal
 Matvey Tingaev

aiohttp/cookiejar.py

@@ -280,10 +280,23 @@ def filter_cookies(
             if is_not_secure and cookie["secure"]:
                 continue
 
-            # It's critical we use the Morsel so the coded_value
-            # (based on cookie version) is preserved
-            mrsl_val = cast("Morsel[str]", cookie.get(cookie.key, Morsel()))
-            mrsl_val.set(cookie.key, cookie.value, cookie.coded_value)
+            # we need to check, if the found cookie is a better match then the
+            # previously found
+            if name in filtered and len(cookie["path"]) < len(filtered[name]["path"]):
+                continue
+
+            filtered[name] = cookie
+
+        # It's critical we use the Morsel so the coded_value
+        # (based on cookie version) is preserved
+        for name in filtered:
+            filtered_cookie = filtered[name]
+            mrsl_val = cast(
+                "Morsel[str]", filtered_cookie.get(filtered_cookie.key, Morsel())
+            )
+            mrsl_val.set(
+                filtered_cookie.key, filtered_cookie.value, filtered_cookie.coded_value
+            )
             filtered[name] = mrsl_val
 
         return filtered

tests/test_cookiejar.py

@@ -704,6 +704,36 @@ async def make_jar():
         self.assertEqual(len(jar_filtered), 1)
         self.assertEqual(jar_filtered["path-cookie"].value, "one")
 
+    def test_path_filter_diff_folder_same_name_return_best_match_independent_from_put_order(
+        self,
+    ) -> None:
+        async def make_jar():
+            return CookieJar(unsafe=True)
+
+        jar = self.loop.run_until_complete(make_jar())
+        jar.update_cookies(
+            SimpleCookie("path-cookie=one; Domain=pathtest.com; Path=/one; ")
+        )
+        jar.update_cookies(
+            SimpleCookie("path-cookie=zero; Domain=pathtest.com; Path=/; ")
+        )
+        jar.update_cookies(
+            SimpleCookie("path-cookie=two; Domain=pathtest.com; Path=/second; ")
+        )
+        self.assertEqual(len(jar), 3)
+
+        jar_filtered = jar.filter_cookies(URL("http://pathtest.com/"))
+        self.assertEqual(len(jar_filtered), 1)
+        self.assertEqual(jar_filtered["path-cookie"].value, "zero")
+
+        jar_filtered = jar.filter_cookies(URL("http://pathtest.com/second"))
+        self.assertEqual(len(jar_filtered), 1)
+        self.assertEqual(jar_filtered["path-cookie"].value, "two")
+
+        jar_filtered = jar.filter_cookies(URL("http://pathtest.com/one"))
+        self.assertEqual(len(jar_filtered), 1)
+        self.assertEqual(jar_filtered["path-cookie"].value, "one")
+
 
 async def test_dummy_cookie_jar() -> None:
     cookie = SimpleCookie("foo=bar; Domain=example.com;")