Skip to content

Commit

Permalink
Validate cookie values wrapped in double-quotes
Browse files Browse the repository at this point in the history
Servers sometimes send headers with cookie values that are encapsulated in double-quotes. Dart should validate values surrounded with double-quotes instead of throwing a FormatException.

This addresses Issue #33327 directly. I applied the solution to this problem that was [solved in Go's code base](https://github.com/golang/go/blob/master/src/net/http/cookie.go#L369).

Closes #33765
#33765

GitOrigin-RevId: 99672dd
Change-Id: Ie95a064611b1aa15aea93f5c8d801ecfc7d996c4
Reviewed-on: https://dart-review.googlesource.com/63920
Reviewed-by: Zach Anderson <zra@google.com>
Commit-Queue: Zach Anderson <zra@google.com>
  • Loading branch information
whesse authored and commit-bot@chromium.org committed Aug 10, 2018
1 parent ac973e5 commit a9ad427
Show file tree
Hide file tree
Showing 2 changed files with 16 additions and 2 deletions.
8 changes: 6 additions & 2 deletions sdk/lib/_http/http_headers.dart
Original file line number Diff line number Diff line change
Expand Up @@ -957,7 +957,7 @@ class _Cookie implements Cookie {
}

void _validate() {
const SEPERATORS = const [
const separators = const [
"(",
")",
"<",
Expand All @@ -980,11 +980,15 @@ class _Cookie implements Cookie {
int codeUnit = name.codeUnits[i];
if (codeUnit <= 32 ||
codeUnit >= 127 ||
SEPERATORS.indexOf(name[i]) >= 0) {
separators.indexOf(name[i]) >= 0) {
throw new FormatException(
"Invalid character in cookie name, code unit: '$codeUnit'");
}
}

if (value[0] == '"' && value[value.length - 1] == '"') {
value = value.substring(1, value.length - 1);
}
for (int i = 0; i < value.length; i++) {
int codeUnit = value.codeUnits[i];
if (!(codeUnit == 0x21 ||
Expand Down
10 changes: 10 additions & 0 deletions tests/standalone_2/io/http_cookie_test.dart
Original file line number Diff line number Diff line change
Expand Up @@ -58,6 +58,16 @@ void testCookies() {
});
}

void testValidateCookieWithDoubleQuotes() {
try {
Cookie cookie = Cookie('key', '"double-quoted-value"');
} catch (e) {
Expect.fail("Unexpected error $e.\n"
"Unable to parse cookie with value in double-quote characters.");
}
}

void main() {
testCookies();
testValidateCookieWithDoubleQuotes();
}

0 comments on commit a9ad427

Please sign in to comment.