Skip to content

Commit e50ff98

Browse files
jeremiahjstaceykwwall
authored andcommitted
Issue 515 (#516)
* Issue 515 Adding tests for getCookies No class changes at this time. Implementing initial tests. * Preventing Null Cookie Name Issue #515 Per kkwall's recommendation, the getValidInput allowNull flag has been updated to false to invalidate cookies with null names. Tests have been updated to account for functional change.
1 parent 766ecc7 commit e50ff98

File tree

2 files changed

+245
-13
lines changed

2 files changed

+245
-13
lines changed

src/main/java/org/owasp/esapi/filters/SecurityWrapperRequest.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -154,7 +154,7 @@ public Cookie[] getCookies() {
154154
// build a new clean cookie
155155
try {
156156
// get data from original cookie
157-
String name = ESAPI.validator().getValidInput("Cookie name: " + c.getName(), c.getName(), "HTTPCookieName", sc.getIntProp("HttpUtilities.MaxHeaderNameSize"), true);
157+
String name = ESAPI.validator().getValidInput("Cookie name: " + c.getName(), c.getName(), "HTTPCookieName", sc.getIntProp("HttpUtilities.MaxHeaderNameSize"), false);
158158
String value = ESAPI.validator().getValidInput("Cookie value: " + c.getValue(), c.getValue(), "HTTPCookieValue", sc.getIntProp("HttpUtilities.MaxHeaderValueSize"), true);
159159
int maxAge = c.getMaxAge();
160160
String domain = c.getDomain();

0 commit comments

Comments
 (0)