Skip to content

Commit

Permalink
Test control characters in Set-Cookie values
Browse files Browse the repository at this point in the history
  • Loading branch information
englehardt committed Mar 29, 2021
1 parent cdde8ac commit 15226db
Show file tree
Hide file tree
Showing 2 changed files with 14 additions and 0 deletions.
9 changes: 9 additions & 0 deletions cookies/bytes.window.js
Original file line number Diff line number Diff line change
Expand Up @@ -7,3 +7,12 @@ promise_test(async t => {
const expected = "cookiesarebananas%3D%FFtest%FF"
assert_equals(get.search(expected), 0, `Needs to contain ${expected} but did not. Full value: ${get}`);
}, "Cookie containing non-UTF-8 bytes");
promise_test(async t => {
t.add_cleanup(async () => { await fetch("resources/bytes.py?delete") });
let response = await fetch("resources/bytes.py?set_ctl");
assert_equals(await response.text(), "set_ctl");
response = await fetch("resources/bytes.py?get_ctl");
const get = await response.text();
const expected = "cookiesarebananas%3D"
assert_equals(get.search(expected), 0, `Needs to contain ${expected} but did not. Full value: ${get}`);
}, "Cookie containing control characters");
5 changes: 5 additions & 0 deletions cookies/resources/bytes.py
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,11 @@ def main(request, response):
response.content = "set"
elif b"get" in request.GET:
response.content = quote(request.headers[b"Cookie"])
elif b"set_ctl" in request.GET:
response.headers.append(b"Set-Cookie", b"cookiesarebananas=\x0Dtest\x0C")
response.content = "set_ctl"
elif b"get_ctl" in request.GET:
response.content = quote(request.headers[b"Cookie"])
elif b"delete" in request.GET:
response.headers.append(b"Set-Cookie", b"cookiesarebananas=meh;Max-Age=0")
response.content = "delete"
Expand Down

0 comments on commit 15226db

Please sign in to comment.