Skip to content

Commit f7f7948

Browse files
ioquatixrafaelfranca
authored andcommitted
Don't try to set invalid cookies.
In Rack 3.1, using invalid cookie keys was deprecated and in Rack 3.2, using an invalid cookie key will raise an exception. Escaping cookie keys is non-standard behaviour and is not understood by clients, e.g. `document.cookies` will contain escaped keys. It also doesn't round-trip correctly, as in, setting a header with a given name won't have the same name in subsequent requests. In addition, the escaping / unescaping behaviour in previous versions of Rack [caused a security issue](GHSA-j6w9-fv6q-3q52).
1 parent 2ebb508 commit f7f7948

File tree

1 file changed

+0
-11
lines changed

1 file changed

+0
-11
lines changed

actionpack/test/dispatch/cookies_test.rb

Lines changed: 0 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -115,11 +115,6 @@ def authenticate
115115
head :ok
116116
end
117117

118-
def set_with_with_escapable_characters
119-
cookies["that & guy"] = "foo & bar => baz"
120-
head :ok
121-
end
122-
123118
def authenticate_for_fourteen_days
124119
cookies["user_name"] = { "value" => "david", "expires" => Time.utc(2005, 10, 10, 5) }
125120
head :ok
@@ -493,12 +488,6 @@ def test_setting_the_same_value_to_permanent_cookie
493488
assert_equal({ "user_name" => "Jamie" }, response.cookies)
494489
end
495490

496-
def test_setting_with_escapable_characters
497-
get :set_with_with_escapable_characters
498-
assert_set_cookie_header "that+%26+guy=foo+%26+bar+%3D%3E+baz; path=/; SameSite=Lax"
499-
assert_equal({ "that & guy" => "foo & bar => baz" }, @response.cookies)
500-
end
501-
502491
def test_setting_cookie_for_fourteen_days
503492
get :authenticate_for_fourteen_days
504493
assert_set_cookie_header "user_name=david; path=/; expires=Mon, 10 Oct 2005 05:00:00 GMT; SameSite=Lax"

0 commit comments

Comments
 (0)