Project

General

Profile

Actions

Bug #12791

closed

Don't allow ,-separator for cookie

Added by naruse (Yui NARUSE) almost 5 years ago. Updated almost 5 years ago.

Status:
Closed
Priority:
Normal
Assignee:
-
Target version:
-
[ruby-core:77416]

Description

RFC2965 allowed both ; and , as a separator for cookie, but RFC6265 only allows ;.

Moreover CVE-2016-7401 uses , as a separator to overwrite CSRF-token.
https://gist.github.com/mala/457a25650950d4daf4144f98159802cc

Actions #1

Updated by naruse (Yui NARUSE) almost 5 years ago

  • Status changed from Open to Closed

Applied in changeset r56262.


  • lib/cgi/cookie.rb (parse): don't allow , as a separator. [Bug #12791]

  • lib/webrick/cookie.rb (parse): ditto.

Actions

Also available in: Atom PDF