Skip to content

java/CookieHandler: escape cookie values when required #14486

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 10 commits into from
Sep 17, 2024
Merged

java/CookieHandler: escape cookie values when required #14486

Changes from 1 commit
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
2a125e1
java/cookie: escape cookie values when required
Delta456 Sep 11, 2024
f45a4b6
add xss escaping
Delta456 Sep 11, 2024
8f9ba84
Merge branch 'trunk' into escape_cookie_value
pujagani Sep 16, 2024
c8167f5
Fix formatting
pujagani Sep 16, 2024
f5342b6
Merge branch 'escape_cookie_value' of https://github.com/Delta456/sel…
pujagani Sep 16, 2024
1146b4c
use string builder
Delta456 Sep 16, 2024
b5d3797
fmt
Delta456 Sep 16, 2024
d89a1b5
Merge branch 'trunk' into escape_cookie_value
Delta456 Sep 16, 2024
b6a9b1a
Merge branch 'trunk' into escape_cookie_value
Delta456 Sep 16, 2024
f0b6deb
Merge branch 'trunk' into escape_cookie_value
pujagani Sep 17, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 15 additions & 3 deletions java/test/org/openqa/selenium/environment/webserver/CookieHandler.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -116,9 +116,9 @@ private Collection<Cookie> getCookies(HttpRequest request) {
private void addCookie(HttpResponse response, Cookie cook) {
StringBuilder cookie = new StringBuilder();

// TODO: escape string as necessary
String name = cook.getName();
cookie.append(name).append("=").append(cook.getValue()).append("; ");
String name = escapeCookieValue(cook.getName());
String value = escapeCookieValue(cook.getValue());
cookie.append(name).append("=").append(value).append("; ");

append(cookie, cook.getDomain(), str -> "Domain=" + str);
append(cookie, cook.getPath(), str -> "Path=" + str);
Expand Down Expand Up @@ -191,4 +191,16 @@ private Cookie parse(String cookieString) {

return builder.build();
}
private String escapeCookieValue(String value) {
if (value == null) {
return "";
}

return value.replace("\\", "\\\\")
.replace("\"", "\\\"")
.replace(";", "\\;")
.replace(",", "\\,")
.replace("\r", "")
.replace("\n", "");
}
}