Harden cookie attribute validation

[tim-smart]

Summary

• validate cookie names using the RFC 6265 token character set
• reject cookie attribute delimiters in domains and paths
• apply the same validation at serialization time for caller-provided cookie objects

Testing

• pnpm --filter effect test --run test/unstable/http/Cookies.test.ts
• pnpm lint
• pnpm check

Closes EFF-210

[changeset-bot]

🦋 Changeset detected

Latest commit: 9b65523

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 29 packages

Name	Type
effect	Patch
@effect/opentelemetry	Patch
@effect/platform-browser	Patch
@effect/platform-bun	Patch
@effect/platform-deno	Patch
@effect/platform-node-shared	Patch
@effect/platform-node	Patch
@effect/vitest	Patch
@effect/ai-anthropic	Patch
@effect/ai-openai-compat	Patch
@effect/ai-openai	Patch
@effect/ai-openrouter	Patch
@effect/atom-react	Patch
@effect/atom-solid	Patch
@effect/atom-vue	Patch
@effect/sql-clickhouse	Patch
@effect/sql-d1	Patch
@effect/sql-libsql	Patch
@effect/sql-mssql	Patch
@effect/sql-mysql2	Patch
@effect/sql-pg	Patch
@effect/sql-pglite	Patch
@effect/sql-sqlite-bun	Patch
@effect/sql-sqlite-do	Patch
@effect/sql-sqlite-node	Patch
@effect/sql-sqlite-react-native	Patch
@effect/sql-sqlite-wasm	Patch
@effect/docgen	Patch
@effect/openapi-generator	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pullfrog]

✅ No new issues found.

Reviewed changes — a focused hardening of cookie attribute validation, extracting shared validation and tightening regexes to reject ; delimiters in names, domains, and paths, then applying that same validation at serialization time.

• RFC 6265 token name validation — cookieNameRegExp replaces the overly permissive fieldContentRegExp for cookie names, correctly rejecting separators and control characters.
• Domain/path delimiter rejection — cookieDomainRegExp / cookiePathRegExp exclude U+003B (;), blocking attribute injection in domain and path values.
• Shared validateCookie — extracted from makeCookie and also called in serializeCookie, so invalid cookies are caught at serialization time regardless of how they entered the Cookies collection.
• Tests — rejection of ; in names, domains, and paths; valid RFC 6265 token names and legitimate domains/paths; and the toSetCookieHeaders throw path for cookies inserted via setCookie and fromIterable.

  ^{｜ View workflow run ｜ Using DeepSeek Pro (free via Pullfrog for OSS) (Kimi K2 not used — the program covers this model; add its provider key to run your pick) ｜ 𝕏}

[github-actions]

Bundle Size Analysis

Generated from PR build output; treat the content below as untrusted.

File Name	Current Size	Previous Size	Difference
basic.ts	6.63 KB	6.63 KB	0.00 KB (0.00%)
batching.ts	9.42 KB	9.42 KB	0.00 KB (0.00%)
brand.ts	6.31 KB	6.31 KB	0.00 KB (0.00%)
cache.ts	10.12 KB	10.12 KB	0.00 KB (0.00%)
config.ts	19.90 KB	19.90 KB	0.00 KB (0.00%)
differ.ts	20.03 KB	20.03 KB	0.00 KB (0.00%)
http-client.ts	20.94 KB	20.94 KB	0.00 KB (0.00%)
logger.ts	10.28 KB	10.28 KB	0.00 KB (0.00%)
metric.ts	8.55 KB	8.55 KB	0.00 KB (0.00%)
optic.ts	7.33 KB	7.33 KB	0.00 KB (0.00%)
pubsub.ts	14.26 KB	14.26 KB	0.00 KB (0.00%)
queue.ts	11.09 KB	11.09 KB	0.00 KB (0.00%)
schedule.ts	10.27 KB	10.27 KB	0.00 KB (0.00%)
schema-class.ts	18.86 KB	18.86 KB	0.00 KB (0.00%)
schema-fromJsonSchemaDocument.ts	28.78 KB	28.78 KB	0.00 KB (0.00%)
schema-representation-roundtrip.ts	25.09 KB	25.09 KB	0.00 KB (0.00%)
schema-string-transformation.ts	12.95 KB	12.95 KB	0.00 KB (0.00%)
schema-string.ts	10.65 KB	10.65 KB	0.00 KB (0.00%)
schema-template-literal.ts	14.85 KB	14.85 KB	0.00 KB (0.00%)
schema-toArbitraryLazy.ts	21.66 KB	21.66 KB	0.00 KB (0.00%)
schema-toCodeDocument.ts	24.10 KB	24.10 KB	0.00 KB (0.00%)
schema-toCodecJson.ts	19.00 KB	19.00 KB	0.00 KB (0.00%)
schema-toEquivalence.ts	18.73 KB	18.73 KB	0.00 KB (0.00%)
schema-toFormatter.ts	18.59 KB	18.59 KB	0.00 KB (0.00%)
schema-toJsonSchemaDocument.ts	22.23 KB	22.23 KB	0.00 KB (0.00%)
schema-toRepresentation.ts	19.27 KB	19.27 KB	0.00 KB (0.00%)
schema.ts	18.12 KB	18.12 KB	0.00 KB (0.00%)
stm.ts	12.05 KB	12.05 KB	0.00 KB (0.00%)
stream.ts	9.37 KB	9.37 KB	0.00 KB (0.00%)