| commit | 4bf72bdb0ff7fb506bb7e91767e2a010a0f39601 | [log] [tgz] |
|---|---|---|
| author | Lily Chen <[email protected]> | Mon Feb 08 22:09:36 2021 |
| committer | Chromium LUCI CQ <[email protected]> | Mon Feb 08 22:09:36 2021 |
| tree | 980cc63fa88c9b96e57420707c53f27c8f647794 | |
| parent | 12d2c587fb312a61e7e05d329f622c52ea777bf8 [diff] |
Cookie parsing: Consider 0x7F (DEL) to be a disallowed control character
Tl;dr: RFC 6265bis does not enforce its syntax for the Set-Cookie line
in its cookie parsing algorithm, citing a desire to be more permissive
than the formal grammar in the name of interoperability. Chrome enforces
a requirement anyway, but was doing so inconsistently, which this fixes.
The Set-Cookie syntax states that the allowable octets for a cookie
value are:
cookie-octet = %x21 / %x23-2B / %x2D-3A / %x3C-5B / %x5D-7E
/ %x80-FF
; octets excluding CTLs,
; whitespace DQUOTE, comma, semicolon,
; and backslash
(https://tools.ietf.org/html/draft-ietf-httpbis-rfc6265bis-07#section-4.1.1)
However, this requirement is only a "SHOULD" on the server's part, and
the User Agent is required to ("MUST") follow a parsing algorithm that
does not include any enforcement of character validity (aside from ";").
Chrome, however, already enforces a (less stringent) requirement that
the semicolon-separated key-value pairs in the cookie line cannot
contain control characters. This is not in the spec, and was apparently
done to address https://crbug.com/238041.
This fixes a bug in that rule, which was previously not considering 0x7F
(DEL) to be a control character. RFC 5234 states that 0x7F is considered
a control character: https://tools.ietf.org/html/rfc5234#appendix-B.1
Bug: 1174647
Change-Id: Idca6032656c283b361b36681839451ca150dd007
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2679562
Reviewed-by: Maksim Orlovich <[email protected]>
Commit-Queue: Lily Chen <[email protected]>
Cr-Commit-Position: refs/heads/master@{#851915}
ChromiumChromium is an open-source browser project that aims to build a safer, faster, and more stable way for all users to experience the web.
The project's web site is https://www.chromium.org.
To check out the source code locally, don't use git clone! Instead, follow the instructions on how to get the code.
Documentation in the source is rooted in docs/README.md.
Learn how to Get Around the Chromium Source Code Directory Structure .
For historical reasons, there are some small top level directories. Now the guidance is that new top level directories are for product (e.g. Chrome, Android WebView, Ash). Even if these products have multiple executables, the code should be in subdirectories of the product.