[BUG] `utils.http` - usage of `http.cookiejar.Cookie()` breaks `http.query` when a cookie contains `max-age`

Description When a query done by salt.utils.query receives a cookie, which contains Max-Age=...., it breaks: TypeError: Cookie.__init__() got an unexpected keyword argument 'max-age'

Setup We upgraded a very ancient Salt environment from 3002.x to 3005.1 when we started seeing this breakage. I could also reproduce it successfully using 3006-rc2 and current master. Salt itself doesn't need any specific setup/configuration, a masterless salt-call http.query is all that's needed, but since emulating an HTTP endpoint which provides the required response is a little bit tricky, using Salt's test suite instead with the following change reproduces this issue as well:

diff --git a/tests/unit/utils/test_http.py b/tests/unit/utils/test_http.py
index d9a84f9582..8236765b33 100644
--- a/tests/unit/utils/test_http.py
+++ b/tests/unit/utils/test_http.py
@@ -152,6 +152,7 @@ class HTTPTestCase(TestCase):
                 "HttpOnly",
                 "SameSite=Lax",
                 "Secure",
+                "Max-Age=3600",
             ]
         )
         ret = http.parse_cookie_header(header)

Please be as specific as possible and give set-up details.

[x] on-prem machine
[x] VM (Virtualbox, KVM, etc. please specify)
[ ] VM running on a cloud service, please be explicit and add details
[x] container (Kubernetes, Docker, containerd, etc. please specify)
[ ] or a combination, please be explicit
[ ] jails if it is FreeBSD
[ ] classic packaging
[x] onedir packaging
[ ] used bootstrap to install

Steps to Reproduce the behavior

Apply the diff above to a checkout of the current master branch
Execute python -m nox -e "pytest-3.10(coverage=False)" -- tests/unit/utils/test_http.py

Result:

tests/unit/utils/test_http.py::HTTPTestCase::test_parse_cookie_header FAILED
[...]
================================================================= FAILURES =================================================================                                                                                                                                            __________________________________________________ HTTPTestCase.test_parse_cookie_header ___________________________________________________                                                                                                                                                                                                                                                                                                                                                                                                                                    self = <tests.unit.utils.test_http.HTTPTestCase testMethod=test_parse_cookie_header>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                def test_parse_cookie_header(self):                                                                                                                                                                                                                                                         header = "; ".join(                                                                                                                                                                                                                                                                         [                                                                                                                                                                                                                                                                                           "foo=bar",                                                                                                                                                                                                                                                                              "expires=Mon, 03-Aug-20 14:26:27 GMT",                                                                                                                                                                                                                                                  "path=/",                                                                                                                                                                                                                                                                               "domain=.mydomain.tld",                                                                                                                                                                                                                                                                 "HttpOnly",                                                                                                                                                                                                                                                                             "SameSite=Lax",                                                                                                                                                                                                                                                                         "Secure",                                                                                                                                                                                                                                                                               "Max-Age=3600",                                                                                                                                                                                                                                                                     ]                                                                                                                                                                                                                                                                                   )                                                                                                                                                                                                                                                                               >       ret = http.parse_cookie_header(header)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  header     = ('foo=bar; expires=Mon, 03-Aug-20 14:26:27 GMT; path=/; domain=.mydomain.tld; '                                                                                                                                                                                             'HttpOnly; SameSite=Lax; Secure; Max-Age=3600')                                                                                                                                                                                                                                        self       = <tests.unit.utils.test_http.HTTPTestCase testMethod=test_parse_cookie_header>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      tests/unit/utils/test_http.py:158:                                                                                                                                                                                                                                                      _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _                                                                                                                                                                                                                                                                                                                                                                                                                                     header = 'foo=bar; expires=Mon, 03-Aug-20 14:26:27 GMT; path=/; domain=.mydomain.tld; HttpOnly; SameSite=Lax; Secure; Max-Age=3600'                                                                                                                                                                                                                                                                                                                                                                                                                                                 def parse_cookie_header(header):                                                                                                                                                                                                                                                            """                                                                                                                                                                                                                                                                                     Parse the "Set-cookie" header, and return a list of cookies.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    This function is here because Tornado's HTTPClient doesn't handle cookies.                                                                                                                                                                                                              """                                                                                                                                                                                                                                                                                     log.error("Header: {}".format(header))                                                                                                                                                                                                                                                  attribs = (
          "expires",
          "path",
          "domain",
          "version",
          "httponly",
          "secure",
          "comment",
          "max-age",
          "samesite",
      )

      # Split into cookie(s); handles headers with multiple cookies defined
      morsels = []
      for item in header.split(";"):
          item = item.strip()
          if "," in item and "expires" not in item:
              for part in item.split(","):
                  morsels.append(part)
          else:
              morsels.append(item)                                                                                                                                                                                                                                           [162/847]

      # Break down morsels into actual cookies
      cookies = []
      cookie = {}
      value_set = False
      for morsel in morsels:
          parts = morsel.split("=")
          parts[0] = parts[0].lower()
          if parts[0] in attribs:
              if parts[0] in cookie:
                  cookies.append(cookie)
                  cookie = {}
              if len(parts) > 1:
                  cookie[parts[0]] = "=".join(parts[1:])
              else:
                  cookie[parts[0]] = True
          else:
              if value_set is True:
                  # This is a new cookie; save the old one and clear for this one
                  cookies.append(cookie)
                  cookie = {}
                  value_set = False
              cookie[parts[0]] = "=".join(parts[1:])
              value_set = True

      if cookie:
          # Set the last cookie that was processed
          cookies.append(cookie)

      # These arguments are required by cookielib.Cookie()
      reqd = (
          "version",
          "port",
          "port_specified",
          "domain",
          "domain_specified",
          "domain_initial_dot",
          "path",
          "path_specified",
          "secure",
          "expires",
          "discard",
          "comment",
          "comment_url",
          "rest",
      )

      ret = []
      for cookie in cookies:
          name = None
          value = None
          for item in list(cookie):
              if item in attribs:
                  continue
              name = item
              value = cookie.pop(item)

          # cookielib.Cookie() requires an epoch
          if "expires" in cookie:
              cookie["expires"] = http.cookiejar.http2time(cookie["expires"])

          # Fill in missing required fields
          for req in reqd:
              if req not in cookie:
                  cookie[req] = ""
          if cookie["version"] == "":
              cookie["version"] = 0
          if cookie["rest"] == "":
              cookie["rest"] = {}
          if cookie["expires"] == "":                                                                                                                                                                                                                                                                 cookie["expires"] = 0                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       # Remove attribs that don't apply to Cookie objects                                                                                                                                                                                                                                     cookie.pop("httponly", None)                                                                                                                                                                                                                                                            cookie.pop("samesite", None)                                                                                                                                                                                                                                                >           ret.append(http.cookiejar.Cookie(name=name, value=value, **cookie))                                                                                                                                                                                                         E           TypeError: Cookie.__init__() got an unexpected keyword argument 'max-age'                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           attribs    = ('expires',                                                                                                                                                                                                                                                                 'path',                                                                                                                                                                                                                                                                                 'domain',                                                                                                                                                                                                                                                                               'version',                                                                                                                                                                                                                                                                              'httponly',                                                                                                                                                                                                                                                                             'secure',                                                                                                                                                                                                                                                                               'comment',                                                                                                                                                                                                                                                                              'max-age',                                                                                                                                                                                                                                                                              'samesite')                                                                                                                                                                                                                                                                            cookie     = {'comment': '',                                                                                                                                                                                                                                                             'comment_url': '',                                                                                                                                                                                                                                                                      'discard': '',                                                                                                                                                                                                                                                                          'domain': '.mydomain.tld',                                                                                                                                                                                                                                                              'domain_initial_dot': '',                                                                                                                                                                                                                                                               'domain_specified': '',                                                                                                                                                                                                                                                                 'expires': 1596464787,                                                                                                                                                                                                                                                                  'max-age': '3600',                                                                                                                                                                                                                                                                      'path': '/',                                                                                                                                                                                                                                                                            'path_specified': '',                                                                                                                                                                                                                                                                   'port': '',                                                                                                                                                                                                                                                                             'port_specified': '',                                                                                                                                                                                                                                                                   'rest': {},                                                                                                                                                                                                                                                                             'secure': True,                                                                                                                                                                                                                                                                         'version': 0}
cookies    = [{'comment': '',
'comment_url': '',
'discard': '',
'domain': '.mydomain.tld',
'domain_initial_dot': '',
'domain_specified': '',
'expires': 1596464787,
'max-age': '3600',
'path': '/',
'path_specified': '',
'port': '',
'port_specified': '',
'rest': {},
'secure': True,
'version': 0}]
header     = ('foo=bar; expires=Mon, 03-Aug-20 14:26:27 GMT; path=/; domain=.mydomain.tld; '
'HttpOnly; SameSite=Lax; Secure; Max-Age=3600')
item       = 'max-age'
morsel     = 'Max-Age=3600'
morsels    = ['foo=bar',
'expires=Mon, 03-Aug-20 14:26:27 GMT',
'path=/',
'domain=.mydomain.tld',
'HttpOnly',
'SameSite=Lax',
'Secure',
'Max-Age=3600']
name       = 'foo'
parts      = ['max-age', '3600']
req        = 'rest'
reqd       = ('version',
'port',
'port_specified',
'domain',
'domain_specified',                                                                                                                                                                                                                                                                     'domain_initial_dot',                                                                                                                                                                                                                                                                   'path',                                                                                                                                                                                                                                                                                 'path_specified',                                                                                                                                                                                                                                                                       'secure',                                                                                                                                                                                                                                                                               'expires',                                                                                                                                                                                                                                                                              'discard',                                                                                                                                                                                                                                                                              'comment',                                                                                                                                                                                                                                                                              'comment_url',                                                                                                                                                                                                                                                                          'rest')                                                                                                                                                                                                                                                                                ret        = []                                                                                                                                                                                                                                                                         value      = 'bar'                                                                                                                                                                                                                                                                      value_set  = True                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               salt/utils/http.py:1007: TypeError                                                                                                                                                                                                                                                      ============================================================= warnings summary =============================================================                                                                                                                                            tests/unit/utils/test_http.py: 34 warnings                                                                                                                                                                                                                                                <frozen importlib._bootstrap>:283: DeprecationWarning: the load_module() method is deprecated and slated for removal in Python 3.12; use exec_module() instead                                                                                                                                                                                                                                                                                                                                                                                                                tests/unit/utils/test_http.py::HTTPTestCase::test_sanitize_url_multiple_elements                                                                                                                                                                                                        tests/unit/utils/test_http.py::HTTPTestCase::test_sanitize_url_no_elements                                                                                                                                                                                                              tests/unit/utils/test_http.py::HTTPTestCase::test_sanitize_url_single_element                                                                                                                                                                                                             /home/eprobst/code-repositories/public/saltstack/salt/salt/utils/http.py:1017: DeprecationWarning: urllib.parse.splitquery() is deprecated as of 3.8, use urllib.parse.urlparse() instead                                                                                                 url_comps = urllib.parse.splitquery(url)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    -- Docs: https://docs.pytest.org/en/stable/how-to/capture-warnings.html                                                                                                                                                                                                                 ========================================================= short test summary info ==========================================================
SKIPPED [1] tests/conftest.py:540: Slow tests are disabled!
SKIPPED [1] tests/unit/utils/test_http.py:208: Missing prerequisites for tornado.curl_httpclient library
FAILED tests/unit/utils/test_http.py::HTTPTestCase::test_parse_cookie_header - TypeError: Cookie.__init__() got an unexpected keyword argument 'max-age'
===================================== 1 failed, 11 passed, 2 skipped, 37 warnings in 138.19s (0:02:18) =====================================
nox > Command python -m pytest --rootdir /home/eprobst/code-repositories/public/saltstack/salt --log-file-level=debug --show-capture=no -ra -s -vv --showlocals --log-file=/home/eprobst/code-repositories/public/saltstack/salt/artifacts/logs/runtests-20230324062009.564412.log --transport=zeromq tests/unit/utils/test_http.py failed with exit code 1
nox > Session test-parametrized-3.10(crypto=None, transport='zeromq', coverage=False) failed.
nox > Ran multiple sessions:
nox > * pytest-3.10(coverage=False): success
nox > * test-3.10(coverage=False): success
nox > * test-parametrized-3.10(crypto=None, transport='zeromq', coverage=False): failed

alternatively:

Execute salt-call --local http.query with cookies=True against an endpoint, which replies with a cookie with a Max-Age=... value.

Result:

Traceback (most recent call last):
File "/var/cache/salt/minion/extmods/modules/http.py", line 46, in query
  return salt.utils.http.query(url=url, opts=opts, **kwargs)
File "/opt/saltstack/salt/lib/python3.10/site-packages/salt/utils/http.py", line 652, in query
  result_cookies = parse_cookie_header(result_headers["Set-Cookie"])
File "/opt/saltstack/salt/lib/python3.10/site-packages/salt/utils/http.py", line 1006, in parse_cookie_header
  ret.append(http.cookiejar.Cookie(name=name, value=value, **cookie))
TypeError: Cookie.__init__() got an unexpected keyword argument 'max-age'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/opt/saltstack/salt/lib/python3.10/site-packages/salt/cli/caller.py", line 202, in call
  ret["return"] = self.minion.executors[fname](
File "/opt/saltstack/salt/lib/python3.10/site-packages/salt/loader/lazy.py", line 149, in __call__
  return self.loader.run(run_func, *args, **kwargs)
File "/opt/saltstack/salt/lib/python3.10/site-packages/salt/loader/lazy.py", line 1232, in run
  return self._last_context.run(self._run_as, _func_or_method, *args, **kwargs)
File "/opt/saltstack/salt/lib/python3.10/site-packages/salt/loader/lazy.py", line 1247, in _run_as
  return _func_or_method(*args, **kwargs)
File "/opt/saltstack/salt/lib/python3.10/site-packages/salt/executors/direct_call.py", line 10, in execute
  return func(*args, **kwargs)
File "/opt/saltstack/salt/lib/python3.10/site-packages/salt/loader/lazy.py", line 149, in __call__
  return self.loader.run(run_func, *args, **kwargs)
File "/opt/saltstack/salt/lib/python3.10/site-packages/salt/loader/lazy.py", line 1232, in run
  return self._last_context.run(self._run_as, _func_or_method, *args, **kwargs)
File "/opt/saltstack/salt/lib/python3.10/site-packages/salt/loader/lazy.py", line 1247, in _run_as
  return _func_or_method(*args, **kwargs)
File "/var/cache/salt/minion/extmods/modules/http.py", line 48, in query
  raise CommandExecutionError(str(exc))

Expected behavior The response to a http.query request is handled without a Traceback.

Versions Report

salt --versions-report

```yaml Salt Version: Salt: 3006.0rc2+101.g85a8358975 Python Version: Python: 3.10.6 (main, Mar 10 2023, 10:55:28) [GCC 11.3.0] Dependency Versions: cffi: Not Installed cherrypy: Not Installed dateutil: Not Installed docker-py: Not Installed gitdb: Not Installed gitpython: Not Installed Jinja2: 3.1.2 libgit2: Not Installed looseversion: 1.1.2 M2Crypto: Not Installed Mako: Not Installed msgpack: 1.0.4 msgpack-pure: Not Installed mysql-python: Not Installed packaging: 21.3 pycparser: Not Installed pycrypto: Not Installed pycryptodome: 3.17 pygit2: Not Installed python-gnupg: Not Installed PyYAML: 6.0 PyZMQ: 25.0.0 relenv: Not Installed smmap: Not Installed timelib: Not Installed Tornado: 4.5.3 ZMQ: 4.3.4 System Versions: dist: ubuntu 22.04.2 jammy locale: utf-8 machine: x86_64 release: 5.15.0-58-generic system: Linux version: Ubuntu 22.04.2 jammy ```

Additional context According to @OrangeDog on Slack, this is a result of Salt using http.cookiejar.Cookie() even though the docs explicitly say not to do that and to use CookieJar.make_cookies() instead.

saltstack / salt

[BUG] `utils.http` - usage of `http.cookiejar.Cookie()` breaks `http.query` when a cookie contains `max-age` #63943