set-cookie not converting [] Cookie Names

[ryanbr]

Prerequisites

• I verified that this is not a filter list issue. Report any issues with filter lists or broken website functionality in the uAssets issue tracker.
• This is not a support issue or a question. For support, questions, or help, visit /r/uBlockOrigin.
• I performed a cursory search of the issue tracker to avoid opening a duplicate issue.
• The issue is not present after disabling uBO in the browser.
• I checked the documentation to understand that the issue I am reporting is not normal behavior.

I tried to reproduce the issue when...

• uBO is the only extension.
• uBO uses default lists and settings.
• using a new, unmodified browser profile.

Description

Using set-cookie, [] isn't translated or with \[ \]

A specific URL where the issue occurs.

https://www.dlalakierni.pl/

Steps to Reproduce

Add the following; to counter the cookie message: (or with \[ \])

dlalakierni.pl##+js(set-cookie, AtomStore[COOKIES_ACCEPTED], 1, , reload, 1)
dlalakierni.pl##+js(set-cookie, AtomStore[FUNCTIONAL_COOKIES_ACCEPTED], 1)
dlalakierni.pl##+js(set-cookie, AtomStore[MARKETING_COOKIES_ACCEPTED], 1)

or,

dlalakierni.pl##+js(set-cookie, AtomStore\[COOKIES_ACCEPTED\], 1, , reload, 1)
dlalakierni.pl##+js(set-cookie, AtomStore\[FUNCTIONAL_COOKIES_ACCEPTED\], 1)
dlalakierni.pl##+js(set-cookie, AtomStore\[MARKETING_COOKIES_ACCEPTED\], 1)

Expected behavior

Doesn't counter cookie message

Actual behavior

translate too AtomStore%5BCOOKIES_ACCEPTED%5D, AtomStore%5BFUNCTIONAL_COOKIES_ACCEPTED%5D, AtomStore%5BMARKETING_COOKIES_ACCEPTED%5D

Instead of

AtomStore[MARKETING_COOKIES_ACCEPTED], AtomStore[FUNCTIONAL_COOKIES_ACCEPTED],AtomStore[COOKIES_ACCEPTED]

uBO version

1.51.1b

Browser name and version

All Bravey baby

Operating System and version

Windows

[gothic-bum]

Per the documentation for set-cookie.js :

The scriptlet encodes cookie names and values, e.g value "{ test: 'value'}" becomes %7B%20test%3A%20'value'%7D.

Per the documentation for trusted-set-cookie.js :

The scriptlet does not encode cookie names and values.

The following filters therefore work - but only if they are from a "trusted source" which is currently the uBO created filter lists (i.e. those prefixed with "uBlock filters – ...") and the user's own filters from "My filters":

dlalakierni.pl##+js(trusted-set-cookie, AtomStore[COOKIES_ACCEPTED], 1, 1year, , reload, 1)
dlalakierni.pl##+js(trusted-set-cookie, AtomStore[FUNCTIONAL_COOKIES_ACCEPTED], 1, 1year)
dlalakierni.pl##+js(trusted-set-cookie, AtomStore[MARKETING_COOKIES_ACCEPTED], 1, 1year)

[ryanbr]

If only setting a simple value of 1 or 0, isn't this fine in set-cookie? Correct me if I'm wrong that trusted support applys to non-boolean values

[gorhill]

I followed AdGuard's reference documentation to implement set-cookie, and this is what it says:

scriptlet encodes cookie names and values

I think the idea is to prevent using set-cookie to set arbitrary values:

...##+js(set-cookie, cookiename=anystring;, allowedvalue)

Encoding the name prevents this.

---

When I enter this at the console of https://example.com/:

document.cookie="cookiename=anystring;=allowedvalue"

Which is what the set-cookie scriptlet would do without encoding, a new cookie cookiename set to anystring is created, which mean without encoding set-cookie would end up having the same functionality as trusted-set-cookie.

[ryanbr]

Okay.

[gorhill]

Maybe we could discuss with @ameshkov a different safety approach: if a cookie name has any character outside the ones considered safe, the scriptlet won't do anything. The unsafe set of characters would be /[^\w%\[\]]/.

[stephenhawk8054]

The unsafe set of characters would be /[^\w%\[\]]/

You mean safe set?

Ah nope, you're correct

[ameshkov]

@gorhill sounds like a good solution. The easiest way would be to follow the RFC, but the problem is that it actually forbids separators including [ ] while Chrome allows any character in a cookie name, even control characters.

Actually, what if we only forbid = and allow any other ASCII character? Do you see any potential problem with that approach?

[iam-py-test]

What about ;? It isn't valid in a cookie name, and can be used to set cookie attributes. Maybe not dangerous as I think most/all of those attributes can already be set and also useless if equal signs are blocked.

[krystian3w]

IMO fine is:

dlalakierni.pl###RodoCookiesInfo:remove()

If nobody can document breakges. The webshop plug-in uses bootstrap, so it can be done in a way that doesn't even meet EU requirements and Google policy.

On older uBo without remove possible too:

dlalakierni.pl###RodoCookiesInfo, .modal-backdrop
dlalakierni.pl##.modal-open:style(overflow: visible !important;)

I guess uBo 1.7.x is unpopular to address by legacy scriptlets (##script:inject() from 2014-2016 (https://www.wikidata.org/wiki/Q19881587#Q19881587\$85FF91CD-4D06-4D10-964E-C7A6FAC2F5C8) (or legacy inline script filtering in Firefox PreQuantum (4-56)).

[gorhill]

Fixed with gorhill/uBlock@11a4856