Project

General

Profile

Bug #12791

Don't allow ,-separator for cookie

Added by naruse (Yui NARUSE) over 3 years ago. Updated over 3 years ago.

Status:
Closed
Priority:
Normal
Assignee:
-
Target version:
-
[ruby-core:77416]

Description

RFC2965 allowed both ; and , as a separator for cookie, but RFC6265 only allows ;.

Moreover CVE-2016-7401 uses , as a separator to overwrite CSRF-token.
https://gist.github.com/mala/457a25650950d4daf4144f98159802cc

#1

Updated by naruse (Yui NARUSE) over 3 years ago

  • Status changed from Open to Closed

Applied in changeset r56262.


  • lib/cgi/cookie.rb (parse): don't allow , as a separator. [Bug #12791]

  • lib/webrick/cookie.rb (parse): ditto.

Also available in: Atom PDF