Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Ensure some cookies don't cause failure #1645

Merged
merged 4 commits into from May 22, 2020
Merged

Ensure some cookies don't cause failure #1645

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
7bb64bc
Ensure some cookies don't cause failure
May 5, 2020
09a60df
Add to changelog
May 5, 2020
f48f0b8
Ignore cookie value and only split on first equals
May 6, 2020
c17569c
Use drop instead of endless range
May 8, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.md
View file
Open in desktop
Expand Up @@ -11,6 +11,7 @@ All notable changes to this project will be documented in this file. For info on
### Fixed

- Avoid NoMethodError when accessing Rack::Session::Cookie without requiring delegate first. ([#1610](https://github.com/rack/rack/issues/1610), [@onigra](https://github.com/onigra))
- Handle cookies with values that end in '=' ([#1645](https://github.com/rack/rack/pull/1645), [@lukaso](https://github.com/lukaso))

## [2.2.2] - 2020-02-11

Expand Down
2 changes: 1 addition & 1 deletion lib/rack/mock.rb
View file
Open in desktop
Expand Up @@ -257,7 +257,7 @@ def identify_cookie_attributes(cookie_filling)
cookie_bits.each do |bit|
if bit.include? '='
cookie_attribute, attribute_value = bit.split('=')
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would it make mores sense to use split('=', 2)?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, also works. Either way, the results of this function are discarded other than for these areas:
https://github.com/rack/rack/pull/1645/files#diff-4fc9bc1f7d91630f4f9f47fc6663f3f7L240-L245

It is probably incorrect to assume '=' is a divider.

A third option is not to process the first element of the cookie_bits array at all, since this is the value. So cookie_bits[1..].each do |bit|.

Fourth option, do both since the value could possibly also contain '='.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done both in f48f0b8

cookie_attributes.store(cookie_attribute.strip, attribute_value.strip)
cookie_attributes.store(cookie_attribute.strip, attribute_value&.strip)
if cookie_attribute.include? 'max-age'
cookie_attributes.store('expires', Time.now + attribute_value.strip.to_i)
end
Expand Down
6 changes: 6 additions & 0 deletions test/spec_mock.rb
View file
Open in desktop
Expand Up @@ -319,6 +319,12 @@
secure_cookie.expires.must_be_nil
end

it "parses cookie headers with equals sign at the end" do
res = Rack::MockRequest.new(->(env) { [200, {"Set-Cookie" => "__cf_bm=_somebase64encodedstringwithequalsatthened=; array=awesome"}, [""]] }).get("")
cookie = res.cookie("__cf_bm")
cookie.value[0].must_equal "_somebase64encodedstringwithequalsatthened="
end

it "return nil if a non existent cookie is requested" do
res = Rack::MockRequest.new(app).get("")
res.cookie("i_dont_exist").must_be_nil
Expand Down