File tree 2 files changed +9
-0
lines changed 2 files changed +9
-0
lines changed Original file line number Diff line number Diff line change 64
64
65
65
var cookie_str_splitter = / [: ] (? = \s * [ a - z A - Z 0 - 9 _ \- ] + \s * [ = ] ) / g;
66
66
Cookie . prototype . parse = function parse ( str , request_domain , request_path ) {
67
+ if ( str . length > 4096 ) {
68
+ console . warn ( "Cookie too long for parsing (>4096 characters)" ) ;
69
+ return ;
70
+ }
71
+
67
72
if ( this instanceof Cookie ) {
68
73
var parts = str . split ( ";" ) . filter ( function ( value ) {
69
74
return ! ! value ;
Original file line number Diff line number Diff line change @@ -67,6 +67,10 @@ assert.equal(cookie.domain, ".test.com");
67
67
assert . equal ( cookie . path , "/" ) ;
68
68
assert . deepEqual ( cookie , new Cookie ( "a=1;domain=.test.com;path=/" ) ) ;
69
69
70
+ // ensure cookies that are too long are not parsed to avoid any issues with DoS inputs
71
+ var too_long_cookie = new Cookie ( "foo=" + "blah" . repeat ( 2000 ) ) ;
72
+ assert . equal ( too_long_cookie , undefined ) ;
73
+
70
74
// Test request_path and request_domain
71
75
test_jar2 . setCookie ( new Cookie ( "sub=4;path=/" , "test.com" ) ) ;
72
76
var cookie = test_jar2 . getCookie ( "sub" , CookieAccessInfo ( "sub.test.com" , "/" ) ) ;
You can’t perform that action at this time.
0 commit comments