Bug #12791: Don't allow ,-separator for cookie

• Status: Closed
• Assignee: -
• Target version: -
• Backport: 2.1: UNKNOWN, 2.2: UNKNOWN, 2.3: UNKNOWN

[naruse (Yui NARUSE)]

RFC2965 allowed both ; and , as a separator for cookie, but RFC6265 only allows ;.

Moreover CVE-2016-7401 uses , as a separator to overwrite CSRF-token.
https://gist.github.com/mala/457a25650950d4daf4144f98159802cc

[naruse (Yui NARUSE)]

• Status changed from Open to Closed

Applied in changeset r56262.

---

• lib/cgi/cookie.rb (parse): don't allow , as a separator. [Bug #12791]

• lib/webrick/cookie.rb (parse): ditto.