Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

net/http/cookie.go: cookie parsing works not as expect #43299

Closed
phpcyy opened this issue Dec 21, 2020 · 1 comment
Closed

net/http/cookie.go: cookie parsing works not as expect #43299

phpcyy opened this issue Dec 21, 2020 · 1 comment

Comments

@phpcyy
Copy link

phpcyy commented Dec 21, 2020

What version of Go are you using (go version)?

go 1.15.6

Does this issue reproduce with the latest release?

Yes

What operating system and processor architecture are you using (go env)?

  1. GOOS="darwin", GOARCH="amd64"
  2. GOOS="linux", GOARCH="amd64"

What did you do?

func TestCookieParse(t *testing.T) {
	req, err := http.NewRequest(http.MethodGet, "http://localhost", nil)
	if err != nil {
		t.Error(err)
		return
	}

	req.Header = http.Header{
		"Cookie": []string{"name=1;;age=2"},
	}

	if c, err := req.Cookie("age"); err != nil {
		t.Error(err)
		return
	} else if c.Value != "2" {
		t.Errorf("age have: %s, want: 2", c.Value)
		return
	}
}

What did you expect to see?

The test passes as expected, and the value of "age" should be "2".

What did you see instead?

The test failed with an error as "http: named cookie not present".

My View

I parsed the same cookie string in PHP and NodeJS, and both of them return the value of "age" as "2".

And I tried the same code in Go 1.12, the value of "age" is also "2".

Is this a bug since Go 1.13 or just a feature ?

If this is a bug, you can fix it just like the below code:

old code in net/http/cookie.go:250

if splitIndex := strings.Index(line, ";"); splitIndex > 0 {

new code

if splitIndex := strings.Index(line, ";"); splitIndex >= 0 {
@phpcyy phpcyy changed the title net/http/cookie.go: cookie parsing works not as espect net/http/cookie.go: cookie parsing works not as expect Dec 21, 2020
@seankhliao
Copy link
Member

This is malformed cookie header according to RFC 6265 Section 5.4.4.2

See #39087 (comment) for the bar for inclusion

@phpcyy phpcyy closed this as completed Dec 22, 2020
@golang golang locked and limited conversation to collaborators Dec 22, 2021
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

No branches or pull requests

3 participants