Skip to content

Commit

Permalink
fix(header): ignore invalid cookies
Browse files Browse the repository at this point in the history
In the spirit of Postel's law, ignore invalid cookies rather than
completely discard the entire Cookie header, which is what the current
code does, and which will lead to confusion when dealing with headers
with invalid cookies injected by proxies and intermediate apps servers.
  • Loading branch information
dorfsmay committed Apr 29, 2017
1 parent 276170f commit 310d98d
Showing 1 changed file with 10 additions and 5 deletions.
15 changes: 10 additions & 5 deletions src/header/common/cookie.rs
Original file line number Diff line number Diff line change
Expand Up @@ -102,8 +102,6 @@ impl Header for Cookie {
let key_val = (key_val.next(), key_val.next());
if let (Some(key), Some(val)) = key_val {
vec_map.insert(key.trim().to_owned().into(), val.trim().to_owned().into());
} else {
return Err(::Error::Header);
}
}
}
Expand Down Expand Up @@ -213,10 +211,20 @@ mod tests {
cookie.append("foo", "bar");
assert_eq!(cookie, parsed);

let parsed = Cookie::parse_header(&b"foo=bar;".to_vec().into()).unwrap();
assert_eq!(cookie, parsed);

let parsed = Cookie::parse_header(&b"foo=bar; baz=quux".to_vec().into()).unwrap();
cookie.append("baz", "quux");
assert_eq!(cookie, parsed);

let parsed = Cookie::parse_header(&b"foo=bar;; baz=quux".to_vec().into()).unwrap();
assert_eq!(cookie, parsed);

let parsed = Cookie::parse_header(&b"foo=bar; invalid ; bad; ;; baz=quux".to_vec().into())
.unwrap();
assert_eq!(cookie, parsed);

let parsed = Cookie::parse_header(&b" foo = bar;baz= quux ".to_vec().into()).unwrap();
assert_eq!(cookie, parsed);

Expand All @@ -241,9 +249,6 @@ mod tests {
.unwrap();
cookie.append("double", "=2");
assert_eq!(cookie, parsed);

Cookie::parse_header(&b"foo;bar=baz;quux".to_vec().into()).unwrap_err();

}
}

Expand Down

0 comments on commit 310d98d

Please sign in to comment.