From cdc8127cd17999708a00aff9718f95aa2fd3154d Mon Sep 17 00:00:00 2001 From: Moonchild Date: Wed, 23 Jul 2025 23:08:52 +0200 Subject: [PATCH] [network] Stop accepting nameless cookies. --- netwerk/cookie/nsCookieService.cpp | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/netwerk/cookie/nsCookieService.cpp b/netwerk/cookie/nsCookieService.cpp index 516261fa22..906513d2b1 100644 --- a/netwerk/cookie/nsCookieService.cpp +++ b/netwerk/cookie/nsCookieService.cpp @@ -3125,6 +3125,15 @@ nsCookieService::SetCookieInternal(nsIURI *aHostURI, COOKIE_LOGFAILURE(SET_COOKIE, aHostURI, savedCookieHeader, "invalid name character"); return newCookie; } + + // RFC 6265 *explicitly* forbids nameless cookies (5.2 step 5) + // Note: we ignore RFC 6265 (bis)'s conflicting stipulation and treat equal-less cookies + // as value-less cookies, not nameless ones. + // This aligns with webkit/Safari and avoids serious sec issues like CVE-2025-8037. + if (cookieAttributes.name.IsEmpty()) { + COOKIE_LOGFAILURE(SET_COOKIE, aHostURI, savedCookieHeader, "nameless cookies are not allowed"); + return newCookie; + } // domain & path checks if (!CheckDomain(cookieAttributes, aHostURI, aKey.mBaseDomain, aRequireHostMatch)) { @@ -3574,15 +3583,11 @@ nsCookieService::ParseAttributes(nsDependentCString &aCookieHeader, // extract cookie & (first attribute), and copy the strings. // if we find multiple cookies, return for processing - // note: if there's no '=', we assume token is . this is required by - // some sites (see bug 169091). - // XXX fix the parser to parse according to grammar for this case + // note: if there's no '=', we assume token is . newCookie = GetTokenValue(cookieStart, cookieEnd, tokenString, tokenValue, equalsFound); + aCookieAttributes.name = tokenString; if (equalsFound) { - aCookieAttributes.name = tokenString; aCookieAttributes.value = tokenValue; - } else { - aCookieAttributes.value = tokenString; } // extract remaining attributes