🔧 fix: sanitize cookie key

Author: SaltyAom

src/compose.ts

@@ -606,16 +606,16 @@ export const composeHandler = ({
 			if (cookieMeta.sign === true)
 				_encodeCookie +=
 					'for(const [key, cookie] of Object.entries(_setCookie)){' +
-					`c.set.cookie[key].value=await signCookie(cookie.value,\`${secret}\`)` +
+					`c.set.cookie[key].value=await signCookie(cookie.value,${!secret ? 'undefined' : overrideUnsafeQuote(secret)})` +
 					'}'
 			else {
 				if (typeof cookieMeta.sign === 'string')
 					cookieMeta.sign = [cookieMeta.sign]
 
 				for (const name of cookieMeta.sign)
 					_encodeCookie +=
-						`if(_setCookie['${name}']?.value)` +
-						`c.set.cookie['${name}'].value=await signCookie(_setCookie['${name}'].value,\`${secret}\`)\n`
+						`if(_setCookie[${overrideUnsafeQuote(name)}]?.value)` +
+						`c.set.cookie[${overrideUnsafeQuote(name)}].value=await signCookie(_setCookie[${overrideUnsafeQuote(name)}].value,${!secret ? 'undefined' : overrideUnsafeQuote(secret)})\n`
 			}
 
 			_encodeCookie += '}\n'

test/core/elysia.test.ts

@@ -420,7 +420,7 @@ describe('Edge Case', () => {
 		})
 	})
 
-	it('handle arbitary code execution from cookie', async () => {
+	it('handle arbitrary code execution from cookie', async () => {
 		const app = new Elysia({
 			cookie: {
 				secrets: `\` + console.log(c.q='pwn') + \``,