netty / netty/netty

Cookie decoder stopped throwing exception on malformed cookie name

Open
#6,730 9 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Java
Stars
35.1k
Forks
16.3k
Avg merge
1d 5h
Merged PRs (30d)
143

Description

We want to switch from 4.0 to 4.1, but with 4.1 cookie decoding changed and on illegal characters cookie decoding procedure doesn't throw exception anymore. The piece of code that was throwing exception was in io.netty.handler.codec.http.cookie.DefaultCookie#DefaultCookie.

Expected behavior

When a cookie contains illegal characters in name/value cookie decoder could, based on some parameter, throw an exception, so the server could handle it.

Actual behavior

There are two modes in CookieDecoder: LAX or STRICT. LAX allowes illegal characters, STRICT swallows malformed cookie. In both cases there is no feedback.

Steps to reproduce

Tests in io.netty.handler.codec.http.cookie.ServerCookieDecoderTest are enough to highlight this situation, specially io.netty.handler.codec.http.cookie.ServerCookieDecoderTest#testRejectCookieValueWithSemicolon

Netty version

Netty 4.1.11.Final

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with io.netty.handler.codec.http.cookie.DefaultCookie#DefaultCookie and the ServerCookieDecoderTest#testRejectCookieValueWithSemicolon test named in the issue. Compare the LAX and STRICT decoder paths and establish how configured feedback should be exposed for malformed cookie names or values. Done means the relevant test covers the expected feedback behavior without losing the decoder mode distinction.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.