Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Inbound cookie values are silently truncated at '&'

Open
  • Is something wrong?
#1,812 1 comment 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 2 days

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
48/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
perl
Domain
backend

Research direction

Start at lib/Dancer2/Core/Request.pm:632 and reproduce the truncation with the provided Perl command, then trace pp_to_header's multi-value cookie encoding. Compare the XS path via HTTP::XSCookies::crush_cookie with the Plack fallback, and review Cookie/value before deciding how inbound values should be handled. Done means the decision is implemented or documented with an unsplit accessor, and both parsing paths behave consistently.

Written by the indexing model from the issue text.

Description

Bug

Status: confirmed against main @ 21bc21d9

lib/Dancer2/Core/Request.pm:632:

value => is_arrayref($value) ? $value : [ split '&', $value ]

This split is an artifact of pp_to_header joining our own multi-value cookies with & — but it is applied to every inbound cookie, including those set by other frameworks, a CDN, or a JavaScript SDK. & is a legal cookie-octet under RFC 6265, and Cookie stringifies to its first value.

Reproduction

perl -Ilib -e 'use Dancer2::Core::Request;
  my $r = Dancer2::Core::Request->new(env=>{REQUEST_METHOD=>"GET",PATH_INFO=>"/",QUERY_STRING=>"",
    HTTP_COOKIE=>"sid=abc&def", "psgi.url_scheme"=>"http",SERVER_NAME=>"l",SERVER_PORT=>80});
  print "sid=[", $r->cookies->{sid}, "] values=(", join("|", $r->cookies->{sid}->values), ")\n"'

sid=[abc] values=(abc|def)

So cookie('sid') silently returns abc for a cookie whose value is abc&def.

This needs a decision, not just a patch

There is no clean back-compatible fix, because Dancer2's own multi-value cookies genuinely are encoded this way and existing applications depend on the split. Options, in order of preference:

  1. Only split when every resulting element round-trips through uri_escape — i.e. when the value actually looks like something pp_to_header produced.
  2. Failing that, document the limitation prominently on Cookie/value and provide an unsplit accessor (raw_value).

Worth checking alongside

The XS path (HTTP::XSCookies::crush_cookie) and the Plack fallback may differ in their url-decoding before this split runs — another install-dependent behaviour difference. Both need verifying against whatever is decided.

Dominant language
Perl
Stars
604
Forks
290
Avg merge
2d 23h
Merged PRs (30d)
3

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from PerlDancer/Dancer2

All issues in PerlDancer/Dancer2

Similar issues

More Perl issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.