Skip to content

Commit a9a320c

Browse files
authored
fix: add a guard against maliciously-sized cookies
1 parent 7d0d631 commit a9a320c

File tree

2 files changed

+9
-0
lines changed

2 files changed

+9
-0
lines changed

cookiejar.js

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,11 @@
6464

6565
var cookie_str_splitter = /[:](?=\s*[a-zA-Z0-9_\-]+\s*[=])/g;
6666
Cookie.prototype.parse = function parse(str, request_domain, request_path) {
67+
if ( str.length > 4096 ) {
68+
console.warn("Cookie too long for parsing (>4096 characters)");
69+
return;
70+
}
71+
6772
if (this instanceof Cookie) {
6873
var parts = str.split(";").filter(function (value) {
6974
return !!value;

tests/test.js

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,10 @@ assert.equal(cookie.domain, ".test.com");
6767
assert.equal(cookie.path, "/");
6868
assert.deepEqual(cookie, new Cookie("a=1;domain=.test.com;path=/"));
6969

70+
// ensure cookies that are too long are not parsed to avoid any issues with DoS inputs
71+
var too_long_cookie = new Cookie( "foo=" + "blah".repeat( 2000 ) );
72+
assert.equal(too_long_cookie, undefined);
73+
7074
// Test request_path and request_domain
7175
test_jar2.setCookie(new Cookie("sub=4;path=/", "test.com"));
7276
var cookie = test_jar2.getCookie("sub", CookieAccessInfo("sub.test.com", "/"));

0 commit comments

Comments
 (0)