Invalid cookies can be created without error
- Vorherrschende Sprache
- Rust
- Sterne
- 24.8k
- Forks
- 1.9k
- Ø Merge
- 23 Std. 10 Min.
- Gemergte PRs (30 T.)
- 26
Beschreibung
[Cookie::set_value](https://docs.rs/actix-web/latest/actix_web/cookie/struct.Cookie.html#method.set_value) accepts any unicode string and never fails, but some unicode strings [are not valid cookie values](https://datatracker.ietf.org/doc/html/rfc6265#section-4.1.1).
Could we add a `try_set_value` method that only accepts valid values ?
Otherwise, we end up with confusing error messages, generated far from where the true source of the error is.
Beitragsleitfaden
Rechercherichtung
Start with Cookie::set_value in the linked API documentation and compare accepted values with RFC 6265 §4.1.1. Done means a try_set_value entry point rejects invalid cookie values and exposes the failure at the call site, with coverage for accepted and rejected values.
Vom Indexierungsmodell aus dem Issue-Text verfasst.
Bewertung
- Tech-Stack
- rust
- Bereich
- api, backend
- Issue-Typ
- Feature
- Schwierigkeit
- 3/5
- Geschätzter Aufwand
- 1-2 Tage
- Aktivitätsstatus
- Veraltet
- Klarheit
- Größtenteils klar
- Anfängerfreundlichkeit
- 38/100