wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-09-09 09:18:42 +09:00
Code Issues Projects Releases Packages Wiki Activity

Port our stricter cookie gating.

Browse source 
This addresses the critical section of #449.
This commit is contained in:
wolfbeast 2018-06-05 15:49:53 +02:00 • committed by Roy Tam
commit b74e38782d
1 changed files with 25 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

38
netwerk/cookie/nsCookieService.cpp
View file

@ -3348,12 +3348,16 @@ nsCookieService::SetCookieInternal(nsIURI *aHostURI,
return newCookie;
}
// Note: For now we allow 0x20 (Space) in cookie names.
// Some websites apparently use cookie names with spaces in them, and the RFC
// doesn't exactly specify what to do in that case, so it's better to keep
// wider compatibility.
const char illegalNameCharacters[] = { 0x01, 0x02, 0x03, 0x04, 0x05, 0x06,
0x07, 0x08, 0x09, 0x0A, 0x0B, 0x0C,
0x0D, 0x0E, 0x0F, 0x10, 0x11, 0x12,
0x13, 0x14, 0x15, 0x16, 0x17, 0x18,
0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E,
0x1F, 0x00 };
0x1F, /* 0x20, */ 0x00 };
if (cookieAttributes.name.FindCharInSet(illegalNameCharacters, 0) != -1) {
COOKIE_LOGFAILURE(SET_COOKIE, aHostURI, savedCookieHeader, "invalid name character");
return newCookie;
@ -3374,18 +3378,26 @@ nsCookieService::SetCookieInternal(nsIURI *aHostURI,
return newCookie;
}
// reject cookie if value contains an RFC 6265 disallowed character - see
// https://bugzilla.mozilla.org/show_bug.cgi?id=1191423
// NOTE: this is not the full set of characters disallowed by 6265 - notably
// 0x09, 0x20, 0x22, 0x2C, 0x5C, and 0x7F are missing from this list. This is
// for parity with Chrome. This only applies to cookies set via the Set-Cookie
// header, as document.cookie is defined to be UTF-8. Hooray for
// symmetry!</sarcasm>
const char illegalCharacters[] = { 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
0x08, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F,
0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16,
0x17, 0x18, 0x19, 0x1A, 0x1B, 0x1C, 0x1D,
0x1E, 0x1F, 0x3B, 0x00 };
// Reject cookie if value contains an RFC 6265 disallowed character.
// See RFC 6265 section 4.1.1
// XXX: For now we allow for web compatibility (see issue #357):
// 0x20 (Space)
// 0x22 (DQUOTE)
// 0x2C (Comma)
// 0x5C (Backslash)
//
// FIXME: Before removing DQUOTE from the exceptions list:
// DQUOTE *cookie-octet DQUOTE is permitted and would fail if just removed.
// This needs better checking for first and last character allowing
// DQUOTE but not in the actual value.
//
// This only applies to cookies set via the Set-Cookie header, since
// document.cookie is defined to be UTF-8.
const char illegalCharacters[] = {
0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0A, 0x0B,
0x0C, 0x0D, 0x0E, 0x0F, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16,
0x17, 0x18, 0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F, /* 0x20, 0x22, */
/* 0x2C, */ 0x3B, /* 0x5C, */ 0x7F, 0x00 };
if (aFromHttp && (cookieAttributes.value.FindCharInSet(illegalCharacters, 0) != -1)) {
COOKIE_LOGFAILURE(SET_COOKIE, aHostURI, savedCookieHeader, "invalid value character");
return newCookie;