Jetty 9.4.51: org.eclipse.jetty.http.HttpCookie.getSetCookie does not handle RFC6265_LEGACY

[atennapel]

Jetty version(s)

9.4.51

Description

org.eclipse.jetty.http.HttpCookie.getSetCookie does not handle RFC6265_LEGACY and will result in IllegalStateException.

How to reproduce?

Set

http.getHttpConfiguration().setRequestCookieCompliance(CookieCompliance.RFC6265_LEGACY);
http.getHttpConfiguration().setResponseCookieCompliance(CookieCompliance.RFC6265_LEGACY);

and add a cookie.

[atennapel]

This is a result of the PR: #9352 . Which is similar to the change for Jetty 10, but there the HttpCookie is also updated to handle the legacy CookieCompliance and in the 9 PR it's not.

Compare https://github.com/eclipse/jetty.project/blob/7f55e82d005436516efd136e2b8362cb64c8411e/jetty-http/src/main/java/org/eclipse/jetty/http/HttpCookie.java#L282 with https://github.com/eclipse/jetty.project/blob/986751c1e1b10814feba9e88eef4870ad9910407/jetty-http/src/main/java/org/eclipse/jetty/http/HttpCookie.java#L286 to see the issue.

[atennapel]

I have an additional question: does using RFC6265_LEGACY mean you are still exposed to https://nvd.nist.gov/vuln/detail/CVE-2023-26049 ?

[joakime]

Keep in mind that Jetty 9.x is now at End of Community Support, you should be on Jetty 10, or Jetty 11, or even Jetty 12 by now.

See:

• End of Community Support for Jetty 9.x - June 2022 #7958

We have testcases in 9.4.51 for RFC6265_LEGACY.

https://github.com/eclipse/jetty.project/blob/jetty-9.4.51.v20230217/jetty-server/src/test/java/org/eclipse/jetty/server/RequestTest.java#L144

Also HttpCookie.getSetCookie(CookieCompliance) is for a generated cookie, we will not generate a bad cookie, that's why that enum doesn't exist there.

CVE-2023-26049 is for a cookie parsing vulnerability. Using RFC6265_LEGACY will expose you to that vulnerability.

[joakime]

Closing, not a Bug, and is also for an End of Community Support release.