Skip to content

parse http.Cookie failure for base64 encoded string #23220

Closed
@sredrv

Description

@sredrv

Describe the bug

The following cookie header received as part of http.Response, failed to be parsed, resulting in 'malformed cookie' error.
fn (r Response) cookies() []Cookie => call did not return 'enctoken' as a cookie, since deep inside parsing failed for base64 encoded string.

Set-Cookie: enctoken=Ln0kBnAaAyYFQ8lH7d5J8Y5w1/iyDRpj6d0nBLTbBUMbtEyPD32rPvpApsvxhLJWlkHuHT3KYL0g/xNBxC9od5tMFAgurLxKdRd5lZ6Pd7W+SllkbsXmUA==; path=/; secure; SameSite=None

Reproduction Steps

base64 encoded strings may end with '=='. While parsing, for key=value pair, the extra '==' at the end, needs to be taken care of.

Expected Behavior

'enctoken' to be parsed and its value to be returned.

Current Behavior

While parsing, we get 'malformed cookie' error.

Possible Solution

$ git diff vlib/net/http/cookie.v
diff --git a/vlib/net/http/cookie.v b/vlib/net/http/cookie.v
index c6ef7af7a..d95733376 100644
--- a/vlib/net/http/cookie.v
+++ b/vlib/net/http/cookie.v
@@ -313,11 +313,11 @@ fn parse_cookie(line string) !Cookie {
}
parts[0] = parts[0].trim_space()
keyval := parts[0].split('=')

  •   if keyval.len != 2 {
    
  •   if keyval.len < 2 {
              return error('malformed cookie')
      }
      name := keyval[0]
    
  •   raw_value := keyval[1]
    
  •   raw_value := keyval[1..].join('=')
      if !is_cookie_name_valid(name) {
              return error('malformed cookie')
      }
    

Additional Information/Context

No response

V version

0.4.8 903e349

Environment details (OS name and version, etc.)

OS: Linux, Kernel: 6.6.59
Gcc: 12.3.0

Note

You can use the 👍 reaction to increase the issue's priority for developers.

Please note that only the 👍 reaction to the issue itself counts as a vote.
Other reactions and those to comments will not be taken into account.

Metadata

Metadata

Assignees

No one assigned

    Labels

    BugThis tag is applied to issues which reports bugs.Unit: vlibBugs/feature requests, that are related to the vlib.

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions