cookie: reject control octets in cookies loaded from a file

[alhudz]

parse_netscape() in lib/cookie.c copies the cookie name and value straight out of the file without the invalid_octets() filtering that a Set-Cookie header goes through. A cookie file whose value holds a control byte (anything 0x01-0x1f or 0x7f) is loaded and then written verbatim into the outgoing Cookie request header, the very bytes that make some servers reject the request and that the HTTP path already drops.

Apply the same invalid_octets() check on the file path, dropping the cookie when its name or value carries a control octet. Putting it in the loader keeps both ingestion paths agreeing on what a valid cookie looks like instead of leaning on the send path to cope. test2311 loads a jar with a 0x07 byte in one value and verifies only the clean cookie reaches the wire.

[Copilot]

Pull request overview

This PR hardens curl’s cookie-jar file loader so it rejects cookies containing control octets in the cookie name or value, aligning file-loaded cookies with the existing filtering applied to cookies received via Set-Cookie headers. It also adds a regression test ensuring such cookies are not emitted in outgoing Cookie: request headers.

Changes:

• Add invalid_octets() filtering for cookie name/value in parse_netscape() (cookie file ingestion path).
• Add new test test2311 that loads a cookie jar containing a value with a control byte and verifies only the clean cookie is sent.
• Register test2311 in the testcases list.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
lib/cookie.c	Drops file-loaded cookies whose name/value contain control octets, matching HTTP cookie parsing rules.
tests/data/test2311	New regression test covering cookie-jar ingestion of a control-octet cookie value.
tests/data/Makefile.am	Adds test2311 to the test suite.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[bagder]

Thanks!