Skip to content

Commit 310d98d

Browse files
committed
fix(header): ignore invalid cookies
In the spirit of Postel's law, ignore invalid cookies rather than completely discard the entire Cookie header, which is what the current code does, and which will lead to confusion when dealing with headers with invalid cookies injected by proxies and intermediate apps servers.
1 parent 276170f commit 310d98d

File tree

1 file changed

+10
-5
lines changed

1 file changed

+10
-5
lines changed

src/header/common/cookie.rs

+10-5
Original file line numberDiff line numberDiff line change
@@ -102,8 +102,6 @@ impl Header for Cookie {
102102
let key_val = (key_val.next(), key_val.next());
103103
if let (Some(key), Some(val)) = key_val {
104104
vec_map.insert(key.trim().to_owned().into(), val.trim().to_owned().into());
105-
} else {
106-
return Err(::Error::Header);
107105
}
108106
}
109107
}
@@ -213,10 +211,20 @@ mod tests {
213211
cookie.append("foo", "bar");
214212
assert_eq!(cookie, parsed);
215213

214+
let parsed = Cookie::parse_header(&b"foo=bar;".to_vec().into()).unwrap();
215+
assert_eq!(cookie, parsed);
216+
216217
let parsed = Cookie::parse_header(&b"foo=bar; baz=quux".to_vec().into()).unwrap();
217218
cookie.append("baz", "quux");
218219
assert_eq!(cookie, parsed);
219220

221+
let parsed = Cookie::parse_header(&b"foo=bar;; baz=quux".to_vec().into()).unwrap();
222+
assert_eq!(cookie, parsed);
223+
224+
let parsed = Cookie::parse_header(&b"foo=bar; invalid ; bad; ;; baz=quux".to_vec().into())
225+
.unwrap();
226+
assert_eq!(cookie, parsed);
227+
220228
let parsed = Cookie::parse_header(&b" foo = bar;baz= quux ".to_vec().into()).unwrap();
221229
assert_eq!(cookie, parsed);
222230

@@ -241,9 +249,6 @@ mod tests {
241249
.unwrap();
242250
cookie.append("double", "=2");
243251
assert_eq!(cookie, parsed);
244-
245-
Cookie::parse_header(&b"foo;bar=baz;quux".to_vec().into()).unwrap_err();
246-
247252
}
248253
}
249254

0 commit comments

Comments
 (0)