-
Notifications
You must be signed in to change notification settings - Fork 183
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Improvements for
Set-Cookie parsing, allow lax parsing of older spe…
…cs (#2368) Motivation: - #2329 made parsing of `set-cookie` header strict according to RFC6265. In practice, there are still many implementations that encode cookies according to the obsolete RFC2965 and/or RFC2109. - Semicolon and space are not validated after a wrapped value. - Without a cookie name in the exception message it's harder to find a problematic cookie. Modifications: - Allow no space after semicolon by default; - Add a system property `io.servicetalk.http.api.headers.cookieParsingStrictRfc6265` to enforce strict parsing; - Instead of blindly skipping `SEMI` and `SP` after `DQUOTE`, validate skipped characters; - Include the cookie name (if already parsed) in all exception messages; - Enhance test coverage for `DefaultHttpSetCookie#parseSetCookie`; Result: 1. No space is required after semicolon by default. 2. Characters after a wrapped value are validated. 3. Exception messages include a cookie name when possible. 4. More test coverage.
- Loading branch information
1 parent
c11d5a9
commit ae4d6d1
Showing
5 changed files
with
243 additions
and
32 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
77 changes: 77 additions & 0 deletions
77
...talk-http-api/src/test/java/io/servicetalk/http/api/DefaultHttpSetCookiesRfc6265Test.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,77 @@ | ||
| /* | ||
| * Copyright © 2022 Apple Inc. and the ServiceTalk project authors | ||
| * | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
| package io.servicetalk.http.api; | ||
|
|
||
| import org.hamcrest.MatcherAssert; | ||
| import org.junit.jupiter.api.AfterAll; | ||
| import org.junit.jupiter.api.BeforeAll; | ||
| import org.junit.jupiter.api.Test; | ||
| import org.junit.jupiter.api.parallel.Execution; | ||
| import org.junit.jupiter.api.parallel.ExecutionMode; | ||
| import org.junit.jupiter.api.parallel.Isolated; | ||
|
|
||
| import static io.servicetalk.http.api.DefaultHttpSetCookiesTest.quotesInValuePreserved; | ||
| import static org.hamcrest.Matchers.allOf; | ||
| import static org.hamcrest.Matchers.containsString; | ||
| import static org.junit.jupiter.api.Assertions.assertThrows; | ||
|
|
||
| @Isolated | ||
| @Execution(ExecutionMode.SAME_THREAD) | ||
| class DefaultHttpSetCookiesRfc6265Test { | ||
|
|
||
| @BeforeAll | ||
| static void enablePedantic() { | ||
| HeaderUtils.cookieParsingStrictRfc6265(true); | ||
| } | ||
|
|
||
| @AfterAll | ||
| static void disablePedantic() { | ||
| HeaderUtils.cookieParsingStrictRfc6265(false); | ||
| } | ||
|
|
||
| @Test | ||
| void throwIfNoSpaceBeforeCookieAttributeValue() { | ||
| final HttpHeaders headers = DefaultHttpHeadersFactory.INSTANCE.newHeaders(); | ||
| headers.add("set-cookie", "first=12345;Extension"); | ||
| headers.add("set-cookie", "second=12345;Expires=Mon, 22 Aug 2022 20:12:35 GMT"); | ||
| headers.add("set-cookie", "third=\"12345\";Expires=Mon, 22 Aug 2022 20:12:35 GMT"); | ||
| throwIfNoSpaceBeforeCookieAttributeValue(headers); | ||
| } | ||
|
|
||
| private static void throwIfNoSpaceBeforeCookieAttributeValue(HttpHeaders headers) { | ||
| Exception exception; | ||
|
|
||
| exception = assertThrows(IllegalArgumentException.class, () -> headers.getSetCookie("first")); | ||
| MatcherAssert.assertThat(exception.getMessage(), | ||
| allOf(containsString("first"), containsString("space is required after ;"))); | ||
|
|
||
| exception = assertThrows(IllegalArgumentException.class, () -> headers.getSetCookie("second")); | ||
| MatcherAssert.assertThat(exception.getMessage(), | ||
| allOf(containsString("second"), containsString("space is required after ;"))); | ||
|
|
||
| exception = assertThrows(IllegalArgumentException.class, () -> headers.getSetCookie("third")); | ||
| MatcherAssert.assertThat(exception.getMessage(), | ||
| allOf(containsString("third"), containsString("space is required after ;"))); | ||
| } | ||
|
|
||
| @Test | ||
| void spaceAfterQuotedValue() { | ||
| final HttpHeaders headers = DefaultHttpHeadersFactory.INSTANCE.newHeaders(); | ||
| headers.add("set-cookie", | ||
| "qwerty=\"12345\"; Domain=somecompany.co.uk; Path=/; Expires=Wed, 30 Aug 2019 00:00:00 GMT"); | ||
| quotesInValuePreserved(headers); | ||
| } | ||
| } |
Oops, something went wrong.