Unsafe UTF-8 decoding of user input

[chris-martin]

The partial function decodeUtf8 is applied here to user input and will throw impurely if the cookie value is not UTF-8.

serversession/serversession/src/Web/ServerSession/Core/Internal.hs

Line 593 in 726e7ac

let maybeInputId = mcookieVal >>= fromPathPiece . TE.decodeUtf8

Since the output here is going into a Maybe context anyway, I think an easy improvement here could be

let maybeInputId =
      mcookieVal
      >>= (either (const Nothing) Just . TE.decodeUtf8')
      >>= fromPathPiece