fix http.cookies: replace backtracking regex with linear-time pattern to prevent ReDoS

Lib/bdb.py

@@ -747,7 +747,7 @@ def clear_all_file_breaks(self, filename):
             return 'There are no breakpoints in %s' % filename
         for line in self.breaks[filename]:
             blist = Breakpoint.bplist[filename, line]
-            for bp in blist:
+            for bp in blist[:]:
                 bp.deleteMe()
         del self.breaks[filename]
         return None

Lib/http/cookies.py

@@ -462,7 +462,7 @@ def OutputString(self, attrs=None):
     (                              # Optional group: there may not be a value.
     \s*=\s*                          # Equal Sign
     (?P<val>                         # Start of group 'val'
-    "(?:\\"|.)*?"                    # Any double-quoted string
+    [^"\\]+                # Any unquoted string (avoid
     |                                  # or
     # Special case for "expires" attr
     (\w{3,6}day|\w{3}),\s              # Day of the week or abbreviated day

Lib/test/test_bdb.py

@@ -1232,6 +1232,23 @@ def test_next_to_botframe(self):
 
 
 class TestRegressions(unittest.TestCase):
+    def test_clear_all_file_breaks_with_multiple_bps_same_line(self):
+        """Regression test: gh-149015.
+        clear_all_file_breaks must remove all breakpoints even when
+        multiple breakpoints share the same (file, line)."""
+        dbg = Bdb()
+        src = canonic(__file__)
+        dbg.set_break(src, 10)
+        dbg.set_break(src, 10)
+        dbg.set_break(src, 10)
+        self.assertEqual(len(Breakpoint.bplist[(src, 10)]), 3)
+        dbg.clear_all_file_breaks(src)
+        self.assertNotIn((src, 10), Breakpoint.bplist)
+        for bp in list(Breakpoint.bpbynumber):
+            if bp is not None:
+                bp.deleteMe()
+
+
     def test_format_stack_entry_no_lineno(self):
         # See gh-101517
         self.assertIn('Warning: lineno is None',

Misc/NEWS.d/next/Library.rst

@@ -0,0 +1,4 @@
+bdb: Fix :meth:`bdb.Bdb.clear_all_file_breaks` to not skip breakpoints when multiple
+breakpoints share the same file and line. Patch by Aman Sachan.
+
+.. bpo-149015.