WebTestClientRequestConverter mishandles cookies whose value contains =#1040
WebTestClientRequestConverter mishandles cookies whose value contains =#1040config25 wants to merge 2 commits intospring-projects:3.0.xfrom
Conversation
4cf5c5a to
ac1b011
Compare
| } | ||
|
|
||
| @Test | ||
| void requestWithCookieValueContainingEqualsSign() { |
There was a problem hiding this comment.
This method has to be public as the 3.0.x branch uses JUnit 4.
There was a problem hiding this comment.
Sorry about that, I missed the JUnit 4 requirement on the 3.0.x branch. Both test methods are now public. Thank you for catching this!
Fixes spring-projectsgh-1038 Signed-off-by: config25 <yhkim052556@naver.com>
ac1b011 to
f0a2e34
Compare
| if (separator == -1) { | ||
| return new RequestCookie(header, ""); | ||
| } |
There was a problem hiding this comment.
I don't think this is correct. To have an empty-string value, I believe the header's value would have to be malformed=. Without the equals sign, there should be no cookie at all as the header is invalid. I think failing in this case is fine so I'd just remove lines 108-110.
There was a problem hiding this comment.
Thanks for the review! I've removed lines 108-110 as suggested.
Since the malformed cookie test (requestWithMalformedCookieHeaderWithoutEqualsSign)
was testing the exact behavior that's now removed, I've also deleted it — failing
in that case is now the expected behavior, as you mentioned.
Signed-off-by: config25 <yhkim052556@naver.com>
f46ceca to
428b3bb
Compare
WebTestClientRequestConverter.createRequestCookie()usessplit("=")toparse cookie headers. This causes two problems:
=(e.g. Base64-padded values likeYWJjZGVm==)are silently truncated at the first
==throwArrayIndexOutOfBoundsExceptionReplace
split("=")withindexOf('=')to split on only the first=andhandle the no-
=case by returning an empty value.Fixes gh-1038
base branch 3.0.x