Skip to content

Commit

Permalink
Improve [trusted-]set-cookie scriptlets
Browse files Browse the repository at this point in the history
As per RFC 6265 the characters ", should be encoded but apparently
browsers don't care. Remove them from the set of characters which
presence trigger encoding.

Related feedback:
uBlockOrigin/uBlock-issues#3178 (comment)
  • Loading branch information
gorhill committed Apr 1, 2024
1 parent 08aa3eb commit 49ff7cf
Showing 1 changed file with 3 additions and 1 deletion.
4 changes: 3 additions & 1 deletion assets/resources/scriptlets.js
Original file line number Diff line number Diff line change
Expand Up @@ -975,7 +975,9 @@ function setCookieFn(
name = encodeURIComponent(name);
}
// https://datatracker.ietf.org/doc/html/rfc6265#section-4.1.1
if ( /[^!#-+\--:<-[\]-~]/.test(value) ) {
// The characters [",] are given a pass from the RFC requirements because
// apparently browsers do not follow the RFC to the letter.
if ( /[^!-:<-[\]-~]/.test(value) ) {
value = encodeURIComponent(value);
}

Expand Down

0 comments on commit 49ff7cf

Please sign in to comment.