Inbound cookie values are silently truncated at '&'

Status: confirmed against main @ 21bc21d9

lib/Dancer2/Core/Request.pm:632:

value => is_arrayref($value) ? $value : [ split '&', $value ]

This split is an artifact of pp_to_header joining our own multi-value cookies with & — but it is applied to every inbound cookie, including those set by other frameworks, a CDN, or a JavaScript SDK. & is a legal cookie-octet under RFC 6265, and Cookie stringifies to its first value.

Reproduction

perl -Ilib -e 'use Dancer2::Core::Request;
  my $r = Dancer2::Core::Request->new(env=>{REQUEST_METHOD=>"GET",PATH_INFO=>"/",QUERY_STRING=>"",
    HTTP_COOKIE=>"sid=abc&def", "psgi.url_scheme"=>"http",SERVER_NAME=>"l",SERVER_PORT=>80});
  print "sid=[", $r->cookies->{sid}, "] values=(", join("|", $r->cookies->{sid}->values), ")\n"'

sid=[abc] values=(abc|def)

So cookie('sid') silently returns abc for a cookie whose value is abc&def.

This needs a decision, not just a patch

There is no clean back-compatible fix, because Dancer2's own multi-value cookies genuinely are encoded this way and existing applications depend on the split. Options, in order of preference:

1. Only split when every resulting element round-trips through uri_escape — i.e. when the value actually looks like something pp_to_header produced.
2. Failing that, document the limitation prominently on Cookie/value and provide an unsplit accessor (raw_value).

Worth checking alongside

The XS path (HTTP::XSCookies::crush_cookie) and the Plack fallback may differ in their url-decoding before this split runs — another install-dependent behaviour difference. Both need verifying against whatever is decided.

Start at lib/Dancer2/Core/Request.pm:632 and reproduce the truncation with the provided Perl command, then trace pp_to_header's multi-value cookie encoding. Compare the XS path via HTTP::XSCookies::crush_cookie with the Plack fallback, and review Cookie/value before deciding how inbound values should be handled. Done means the decision is implemented or documented with an unsplit accessor, and both parsing paths behave consistently.