Cookie decoder stopped throwing exception on malformed cookie name
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 35.1k
- Forks
- 16.3k
- Avg merge
- 1d 5h
- Merged PRs (30d)
- 143
Description
We want to switch from 4.0 to 4.1, but with 4.1 cookie decoding changed and on illegal characters cookie decoding procedure doesn't throw exception anymore. The piece of code that was throwing exception was in io.netty.handler.codec.http.cookie.DefaultCookie#DefaultCookie.
Expected behavior
When a cookie contains illegal characters in name/value cookie decoder could, based on some parameter, throw an exception, so the server could handle it.
Actual behavior
There are two modes in CookieDecoder: LAX or STRICT. LAX allowes illegal characters, STRICT swallows malformed cookie. In both cases there is no feedback.
Steps to reproduce
Tests in io.netty.handler.codec.http.cookie.ServerCookieDecoderTest are enough to highlight this situation, specially io.netty.handler.codec.http.cookie.ServerCookieDecoderTest#testRejectCookieValueWithSemicolon
Netty version
Netty 4.1.11.Final
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with io.netty.handler.codec.http.cookie.DefaultCookie#DefaultCookie and the ServerCookieDecoderTest#testRejectCookieValueWithSemicolon test named in the issue. Compare the LAX and STRICT decoder paths and establish how configured feedback should be exposed for malformed cookie names or values. Done means the relevant test covers the expected feedback behavior without losing the decoder mode distinction.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100