cookie: fix rejection when tabs in value

[bagder]

A previous refactor changed the TAB check so that the octet could be accepted in the 'path', which would cause an invalid line in the saved cookie file so not possible to read the cookie back. Not terrible because the path cannot contain a raw tab so it would never match anyway.

Add test 1685 to verify

Reported-by: Izan on hackerone

[Copilot]

Pull request overview

This PR fixes libcurl’s cookie parsing so cookies containing a raw TAB in a parsed name=value token (including attributes like path) are rejected early, preventing invalid tab-delimited lines from being written to the cookie jar and later becoming unreadable.

Changes:

• Move the TAB-in-value rejection check to apply to all name=value segments in Set-Cookie parsing (including attributes like path).
• Add regression test test1685 covering a cookie with a TAB in the path attribute and verifying only the valid cookie is persisted.
• Register the new test in the testcases list.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
lib/cookie.c	Rejects cookies containing TABs in any parsed name=value value during Set-Cookie header parsing.
tests/data/test1685	New test ensuring cookies with TAB in path are dropped and do not corrupt the saved cookie jar.
tests/data/Makefile.am	Adds test1685 to the test suite’s testcase list.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[bagder]

augment review

[augmentcode]

🤖 Augment PR Summary

Summary: Fix cookie parsing so Set-Cookie pairs with HTABs in their values are rejected consistently.

Changes:

• Move the TAB-in-val check earlier in parse_cookie_header() so it applies to all name=value pairs (including path).
• Add regression test test1685 verifying that a cookie with a TAB in the path attribute is dropped while a subsequent valid cookie is still persisted to the cookie jar.

Technical Notes: This prevents writing malformed Netscape cookie-jar lines (tab-delimited) that cannot be read back, matching the RFC6265 cookie-octet restrictions.

_{🤖 Was this summary useful? React with 👍 or 👎}

[augmentcode]

Review completed. No suggestions at this time.

Comment augment review to trigger a new review at any time.