i2p/haiku-beta6
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Limit cookie value size to 4096 bytes.

Browse Source 
Too big cookies will make most web servers reject requests.
This commit is contained in:
Adrien Destugues
2014-06-09 08:50:29 +02:00
parent 056b2e33e5
commit f7e7eeba4a
1 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/kits/network/libnetapi/NetworkCookie.cpp
+6 -2
View File
@@ -1,8 +1,9 @@
/* /*
* Copyright 2010-2013 Haiku Inc. All rights reserved. * Copyright 2010-2014 Haiku Inc. All rights reserved.
* Distributed under the terms of the MIT License. * Distributed under the terms of the MIT License.
* *
* Authors: * Authors:
* Adrien Destugues, [email protected]
* Christophe Huriaux, [email protected] * Christophe Huriaux, [email protected]
* Hamish Morrison, [email protected] * Hamish Morrison, [email protected]
*/ */
@@ -121,7 +122,7 @@ BNetworkCookie::ParseCookieString(const BString& string, const BUrl& url)
// Parse the name and value of the cookie // Parse the name and value of the cookie
index = _ExtractNameValuePair(string, name, value, index); index = _ExtractNameValuePair(string, name, value, index);
if (index == -1) { if (index == -1 || value.Length() > 4096) {
// The set-cookie-string is not valid // The set-cookie-string is not valid
return B_BAD_DATA; return B_BAD_DATA;
} }
@@ -154,9 +155,12 @@ BNetworkCookie::ParseCookieString(const BString& string, const BUrl& url)
} }
// Validate the max-age value. // Validate the max-age value.
char* end = NULL; char* end = NULL;
errno = 0;
long maxAge = strtol(value.String(), &end, 10); long maxAge = strtol(value.String(), &end, 10);
if (*end == '\0') if (*end == '\0')
SetMaxAge((int)maxAge); SetMaxAge((int)maxAge);
else if(errno == ERANGE && maxAge == LONG_MAX)
SetMaxAge(INT_MAX);
else else
SetMaxAge(-1); // cookie will expire immediately SetMaxAge(-1); // cookie will expire immediately
} else if (name.ICompare("expires") == 0) { } else if (name.ICompare("expires") == 0) {