qbit/go
1
0
Fork 0
mirror of https://github.com/golang/go synced 2024-11-23 20:40:07 -07:00
Code Releases Activity

net/http: send more cookie values in double quotes

Browse Source 
According to RFC 6255 a cookie value may contain neither spaces " "
nor commas ",". But browsers seem to handle these pretty well and such
values are not uncommon in the wild so we do allow spaces and commas
in cookie values too. Up to now we use the double-quoted wire format
only for cookie values with leading and/or trailing spaces and commas.
Values with internal spaces/commas are sent without the optional double
quotes. This seems to be a problem for some agents.

This CL changes the behaviour for cookie values with spaces or commas:
Such values are always sent in double quotes. This should not have
any impact on existing agents and the increases of data transmitted
is negligible.

Fixes #18627

Change-Id: I575a98d589e048aa39d976a3c984550daaca730a
Reviewed-on: https://go-review.googlesource.com/37328
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
This commit is contained in:
Volker Dobler 2017-02-22 14:40:17 +01:00 committed by Brad Fitzpatrick
parent 1611839b29
commit 8f6d68ebaa
2 changed files with 7 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/net/http/cookie.go
View File

@ -328,7 +328,7 @@ func sanitizeCookieValue(v string) string {
if len(v) == 0 { if len(v) == 0 {
return v return v
} }
if v[0] == ' ' || v[0] == ',' || v[len(v)-1] == ' ' || v[len(v)-1] == ',' { if strings.IndexByte(v, ' ') >= 0 || strings.IndexByte(v, ',') >= 0 {
return `"` + v + `"` return `"` + v + `"`
} }
return v return v

9
src/net/http/cookie_test.go
View File

@ -69,7 +69,7 @@ var writeSetCookiesTests = []struct {
// are disallowed by RFC 6265 but are common in the wild. // are disallowed by RFC 6265 but are common in the wild.
{ {
&Cookie{Name: "special-1", Value: "a z"}, &Cookie{Name: "special-1", Value: "a z"},
`special-1=a z`, `special-1="a z"`,
}, },
{ {
&Cookie{Name: "special-2", Value: " z"}, &Cookie{Name: "special-2", Value: " z"},
@ -85,7 +85,7 @@ var writeSetCookiesTests = []struct {
}, },
{ {
&Cookie{Name: "special-5", Value: "a,z"}, &Cookie{Name: "special-5", Value: "a,z"},
`special-5=a,z`, `special-5="a,z"`,
}, },
{ {
&Cookie{Name: "special-6", Value: ",z"}, &Cookie{Name: "special-6", Value: ",z"},
@ -398,9 +398,12 @@ func TestCookieSanitizeValue(t *testing.T) {
{"foo\"bar", "foobar"}, {"foo\"bar", "foobar"},
{"\x00\x7e\x7f\x80", "\x7e"}, {"\x00\x7e\x7f\x80", "\x7e"},
{`"withquotes"`, "withquotes"}, {`"withquotes"`, "withquotes"},
{"a z", "a z"}, {"a z", `"a z"`},
{" z", `" z"`}, {" z", `" z"`},
{"a ", `"a "`}, {"a ", `"a "`},
{"a,z", `"a,z"`},
{",z", `",z"`},
{"a,", `"a,"`},
} }
for _, tt := range tests { for _, tt := range tests {
if got := sanitizeCookieValue(tt.in); got != tt.want { if got := sanitizeCookieValue(tt.in); got != tt.want {