net/http: readCookies accepts empty cookie in 1.18

[hidu]

What version of Go are you using (go version)?

$ go version
go1.17.10

Does this issue reproduce with the latest release?

No

go1.13 - go1.17 can reproduce it.
go1.12、go1.18 can not reproduce it.

What operating system and processor architecture are you using (go env)?

go env Output

$ go env

What did you do?

req, _ := http.NewRequest("get", "http://www.example.com/", nil)

req.Header["Cookie"] = []string{"a=va;;b=vb"}  // Cookie with continuous semicolon

fmt.Println(req.Cookie("a"))
// go1.12   ->  a=va <nil>
// go1.13   ->  a=va <nil>
// go1.17   ->  a=va <nil>
// go1.18   ->  a=va <nil>


fmt.Println(req.Cookie("b"))
// go1.12   ->   b=vb <nil>
// go1.13   ->  http: named cookie not present
// go1.17   ->  http: named cookie not present
// go1.18   ->   b=vb <nil>

https://go.dev/play/p/WLdtvbm5FHx?v=goprev

What did you expect to see?

same as go1.18/go1.12 's result:

a=va <nil>
b=vb <nil>

What did you see instead?

a=va <nil>
 http: named cookie not present

How to Fix

go/src/net/http/cookie.go

Line 259 in 085c61a

if splitIndex := strings.Index(line, ";"); splitIndex > 0 {

fix it：

if splitIndex := strings.Index(line, ";"); splitIndex >= 0 {

[seankhliao]

Duplicate of #43299

[hidu]

@seankhliao

in this case，go1.18 has different result with go1.17

go1.18 works fine, so go1.18 has a bug?

[seankhliao]

maybe, looks like the change was made switching to strings.Cut

cc @neild and @rsc who made the change

[hidu]

The result was always changing in different version.
The Cookie also from Android APP, like #39087 (comment)