Project

General

Profile

Bug #12791

Don't allow ,-separator for cookie

Added by naruse (Yui NARUSE) almost 3 years ago. Updated almost 3 years ago.

Status:
Closed
Priority:
Normal
Assignee:
-
Target version:
-
[ruby-core:77416]

Description

RFC2965 allowed both ; and , as a separator for cookie, but RFC6265 only allows ;.

Moreover CVE-2016-7401 uses , as a separator to overwrite CSRF-token.
https://gist.github.com/mala/457a25650950d4daf4144f98159802cc

Associated revisions

Revision 5f33c6b0
Added by naruse (Yui NARUSE) almost 3 years ago

  • lib/cgi/cookie.rb (parse): don't allow , as a separator. [Bug #12791]

  • lib/webrick/cookie.rb (parse): ditto.

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@56262 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

Revision 56262
Added by naruse (Yui NARUSE) almost 3 years ago

  • lib/cgi/cookie.rb (parse): don't allow , as a separator. [Bug #12791]

  • lib/webrick/cookie.rb (parse): ditto.

Revision 56262
Added by naruse (Yui NARUSE) almost 3 years ago

  • lib/cgi/cookie.rb (parse): don't allow , as a separator. [Bug #12791]

  • lib/webrick/cookie.rb (parse): ditto.

Revision 56262
Added by naruse (Yui NARUSE) almost 3 years ago

  • lib/cgi/cookie.rb (parse): don't allow , as a separator. [Bug #12791]

  • lib/webrick/cookie.rb (parse): ditto.

Revision 56262
Added by naruse (Yui NARUSE) almost 3 years ago

  • lib/cgi/cookie.rb (parse): don't allow , as a separator. [Bug #12791]

  • lib/webrick/cookie.rb (parse): ditto.

History

#1

Updated by naruse (Yui NARUSE) almost 3 years ago

  • Status changed from Open to Closed

Applied in changeset r56262.


  • lib/cgi/cookie.rb (parse): don't allow , as a separator. [Bug #12791]

  • lib/webrick/cookie.rb (parse): ditto.

Also available in: Atom PDF