| Subject: | Fixes to handle valueless cookies |
Distribution: CGI-Cookie-XS-0.16
Perl: This is perl, v5.8.8 built for x86_64-linux-thread-multi-ld
v0.16 doesn't handle cookies that have no value:
%perl -MData::Dumper -MCGI::Cookie::XS -e 'my $s =
"lastvisit=1251731074; sessionlogin=1251760758; username=; password=;
remember_login=; admin_button=";
die "Version: $CGI::Cookie::XS::VERSION\n",
Data::Dumper->Dump([ CGI::Cookie::XS->parse($s) ]), "\n";'
Version: 0.16
$VAR1 = {
'lastvisit' => [
'1251731074'
],
'sessionlogin' => [
'1251760758'
],
'remember_login' => [
'; admin_button='
],
'username' => [
'; password='
]
};
Obviously the "username" cookie should not have the value "; password="
This is caused in the detection of the end of the cookie name. The patch
only allows the p++ to occur if the next character isn't a semi-colon,
comma or the end of the string.
This causes the result to be what you would expect:
perl -Mblib=lib -MData::Dumper -MCGI::Cookie::XS -e 'my $s =
"lastvisit=1251731074; sessionlogin=1251760758; username=; password=;
remember_login=; admin_button="; die "Version:
$CGI::Cookie::XS::VERSION\n", Data::Dumper->Dump([
CGI::Cookie::XS->parse($s) ]), "\n";'
Version: 0.16
$VAR1 = {
'lastvisit' => [
'1251731074'
],
'password' => [],
'sessionlogin' => [
'1251760758'
],
'admin_button' => [],
'remember_login' => [],
'username' => []
};
Hope this helps someone.
| Subject: | XS.xs.patch |
--- XS.xs.old 2009-08-31 20:28:20.000000000 -0400
+++ XS.xs 2009-08-31 20:31:57.000000000 -0400
@@ -60,7 +60,12 @@
//DDD("in loop");
if (*p == '=' && !parsing_value ){
array = newAV();
- *p = '\0'; p++;
+ *p = '\0';
+
+ // Only move on if not the end of the cookie value
+ if (*(p+1) != ';' && *(p+1) != ',' && *(p+1) != '\0')
+ p++;
+
_decode_hex_str(q, &decode);
q = p;
hv_store(
@@ -75,7 +80,7 @@
p++;
_decode_hex_str(q, &decode);
q = p;
- if (parsing_value && array != NULL)
+ if (*decode != '\0' && parsing_value && array != NULL)
av_push(array, newSVpvf("%s", decode));
parsing_value = FALSE;
} else if (*p == '&') { // find a second value