root
/
spring-framework
mirror of https://github.com/spring-projects/spring-framework.git
1
0
Fork 0
Code Issues Actions 8 Packages Projects Releases Wiki Activity

Relax domain name checks in ResponseCookie 

Closes gh-23924
This commit is contained in:
Rossen Stoyanchev 2019-11-06 16:17:41 +00:00
parent 29599a93a4
commit 3a241b546f
2 changed files with 16 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
spring-web/src/main/java/org/springframework/http/ResponseCookie.java
View File

@ -374,7 +374,7 @@ public final class ResponseCookie extends HttpCookie {
}
int char1 = domain.charAt(0);
int charN = domain.charAt(domain.length() - 1);
if (char1 == '.' || char1 == '-' || charN == '.' || charN == '-') {
if (char1 == '-' || charN == '.' || charN == '-') {
throw new IllegalArgumentException("Invalid first/last char in cookie domain: " + domain);
}
for (int i = 0, c = -1; i < domain.length(); i++) {

15
spring-web/src/test/java/org/springframework/http/ResponseCookieTests.java
View File

@ -66,4 +66,19 @@ public class ResponseCookieTests {
.hasMessageContaining("RFC2616 cookie value"));
}
@Test
public void domainChecks() {
Arrays.asList("abc", "abc.org", "abc-def.org", "abc3.org", ".abc.org")
.forEach(domain -> ResponseCookie.from("n", "v").domain(domain).build());
Arrays.asList("-abc.org", "abc.org.", "abc.org-", "-abc.org", "abc.org-")
.forEach(domain -> assertThatThrownBy(() -> ResponseCookie.from("n", "v").domain(domain).build())
.hasMessageContaining("Invalid first/last char"));
Arrays.asList("abc..org", "abc.-org", "abc-.org")
.forEach(domain -> assertThatThrownBy(() -> ResponseCookie.from("n", "v").domain(domain).build())
.hasMessageContaining("invalid cookie domain char"));
}
}