Cookie attribute injection: name/path/domain unescaped in pp_to_header
Maintainers usually reply within 2 days
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 68/100
Research direction
Start with lib/Dancer2/Core/Cookie.pm:51-66 and trace both pp_to_header and xs_to_header, including the HTTP::XSCookies::bake_cookie path. Confirm how name, path, and domain handle semicolons, commas, whitespace, and control characters, then make the two paths reject invalid input consistently. Done means cookie attributes cannot be injected through these fields and both implementations agree.
Written by the indexing model from the issue text.
Description
Severity: low (requires application cooperation) · Status: reasoned from code
lib/Dancer2/Core/Cookie.pm:51-66:
my $value = join( '&', map uri_escape($_), $self->value ); # value: escaped
my @headers = $self->name . '=' . $value; # name: raw
push @headers, "Path=" . $self->path if $self->path; # raw
push @headers, "Domain=" . $self->domain if $self->domain; # raw
The value is uri_escaped, but name, path and domain are concatenated raw. A ; in an application-supplied path, domain or name injects arbitrary cookie attributes (Domain=, Path=, Secure, SameSite=).
Reaching it requires the application to build a cookie from user input, hence low.
Suggested fix
Reject rather than silently mangle, since a ; in any of these is always a programming error:
for my $attr (qw< name path domain >) {
my $v = $self->$attr;
defined $v && $v =~ /[;,\s[:cntrl:]]/
and croak "Invalid character in cookie $attr: '$v'";
}
Worth checking alongside
The XS path (xs_to_header, delegating to HTTP::XSCookies::bake_cookie) may already handle some of this. Which path runs depends on whether HTTP::XSCookies is installed, so the two should be made to agree — otherwise this is another install-dependent behaviour difference.
- Dominant language
- Perl
- Stars
- 604
- Forks
- 290
- Avg merge
- 3d 7h
- Merged PRs (30d)
- 2
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from PerlDancer/Dancer2
-
Add .gitattributes so share/skel keeps LF on a Windows git checkoutPossibly taken @sadhana-s-codez claimed this 5 days ago. Open
Difficulty 1/5 Under an hour Newbie friendliness 85/100
PerlDancer/Dancer2#1854 · 1 comment ·
Maintainers usually reply within 2 days
-
dancer2 gen -c writes the Dockerfile outside the app directoryPossibly taken @sjh9714 claimed this 3 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
PerlDancer/Dancer2#1851 ·
Maintainers usually reply within 2 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
PerlDancer/Dancer2#1850 ·
Maintainers usually reply within 2 days
-
Bug
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
PerlDancer/Dancer2#1820 ·
Maintainers usually reply within 2 days
-
Enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
PerlDancer/Dancer2#1819 ·
Maintainers usually reply within 2 days
All issues in PerlDancer/Dancer2
Similar issues
-
fix(api): API v3 Product Read ignores request language (lc) for sample products and image URLsPossibly taken @muntasir-396 claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
openfoodfacts/openfoodfacts-server#15042 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
libwww-perl/URI#211 ·
-
Type: Bug
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
inverse-inc/packetfence#9549 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100