Aren/haiku
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Limit cookie value size to 4096 bytes.

Browse Source 
Too big cookies will make most web servers reject requests.
This commit is contained in:
Adrien Destugues 2014-06-09 08:50:29 +02:00
parent 056b2e33e5
commit f7e7eeba4a
1 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/kits/network/libnetapi/NetworkCookie.cpp
View File

@ -1,8 +1,9 @@
/*
* Copyright 2010-2013 Haiku Inc. All rights reserved.
* Copyright 2010-2014 Haiku Inc. All rights reserved.
* Distributed under the terms of the MIT License.
*
* Authors:
* Adrien Destugues, pulkomandy@pulkomandy.tk
* Christophe Huriaux, c.huriaux@gmail.com
* Hamish Morrison, hamishm53@gmail.com
*/
@ -121,7 +122,7 @@ BNetworkCookie::ParseCookieString(const BString& string, const BUrl& url)
// Parse the name and value of the cookie
index = _ExtractNameValuePair(string, name, value, index);
if (index == -1) {
if (index == -1 || value.Length() > 4096) {
// The set-cookie-string is not valid
return B_BAD_DATA;
}
@ -154,9 +155,12 @@ BNetworkCookie::ParseCookieString(const BString& string, const BUrl& url)
}
// Validate the max-age value.
char* end = NULL;
errno = 0;
long maxAge = strtol(value.String(), &end, 10);
if (*end == '\0')
SetMaxAge((int)maxAge);
else if(errno == ERANGE && maxAge == LONG_MAX)
SetMaxAge(INT_MAX);
else
SetMaxAge(-1); // cookie will expire immediately
} else if (name.ICompare("expires") == 0) {