gh-159642: Fix quadratic complexity in http.cookiejar header parsing

[digit50]

closes #159642

split_header_words() consumed one token at a time and rebuilt the rest of the header string after each one (through unmatched() or text.lstrip()[1:]), so parsing took time quadratic in the header length. CookieJar.extract_cookies() runs it on every Set-Cookie2 header whenever the response also has a Set-Cookie header, including under the default policy, so a server could keep a client busy for minutes with one large folded header.

This change keeps a position in the text and applies each regular expression with match(text, pos) instead of slicing. The ^ anchors are dropped from the header regular expressions because match() already anchors at the given position, and the comma and junk checks become two small compiled patterns. The result is the same as before; I also compared the old and new functions on 200,000 random short inputs built from the separator characters, quotes, backslashes and Unicode whitespace, with no differences.

The new test test_split_header_words_large parses a 1.2 MB header made of a=1; b="2", repeated 10**6 times and checks the result. It takes about a second with the change and did not finish within two minutes without it. It is marked with the cpu resource, like test_unquote_large in test_http_cookies.

• Issue: http.cookiejar split_header_words is quadratic in the Set-Cookie2 length #159642

[python-cla-bot]

All commit authors signed the Contributor License Agreement.