-
Notifications
You must be signed in to change notification settings - Fork 4.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
fix(core): definition of cookie name validate #11881
Conversation
This regex looks simpler (and whitelist feels safer than blacklist): @StarlightIbuki what do you think? |
5a63970
to
06e078a
Compare
Applied the change. And notice the code you refer to also uses a blacklist. |
8d59232
to
d63e87b
Compare
56dd141
to
a332fd8
Compare
f8bbdeb
to
5a2cb3e
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Typo, otherwise looks good to me.
Ah, damn, you are right. I read it wrong. |
|
||
typedefs.cookie_name = Schema.define { | ||
type = "string", | ||
custom_validator = utils.validate_cookie_name, |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
If the function is only used here, please remove it from utils and into typedefs.lua
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It's unit-tested so it needs to be exported. Also before the patch, this function was already exported and in the util module.
91793ef
to
436693d
Compare
@hanshuebner Could you review this again? |
9114c7b
to
8b88a97
Compare
Cherry-pick failed for Please cherry-pick the changes locally. git remote add upstream https://github.com/kong/kong-ee
git fetch upstream master
git worktree add -d .worktree/cherry-pick-11881-to-master-to-upstream upstream/master
cd .worktree/cherry-pick-11881-to-master-to-upstream
git checkout -b cherry-pick-11881-to-master-to-upstream
ancref=$(git merge-base 5f34a49edc356b798f25a340522d8efe2c4f5d95 8b88a976268f1c211962b309c9017e9d8b291883)
git cherry-pick -x $ancref..8b88a976268f1c211962b309c9017e9d8b291883 |
Summary
We have a too strong limitation on the character used in cookie names. For example "." should be allowed.
We choose not to do the same to the header because we rely on Nginx's API to handle headers, which has more strict restrictions on the characters.
Checklist
changelog/unreleased/kong
orskip-changelog
label added on PR if changelog is unnecessary. README.mdFull changelog
Issue reference
Fix #11860