value-ctl.html (2565B)
1 <!doctype html> 2 <html> 3 <head> 4 <meta charset=utf-8> 5 <title>Test cookie value parsing with control characters</title> 6 <meta name=help href="https://tools.ietf.org/html/rfc6265#section-5.2"> 7 <meta name="timeout" content="long"> 8 <script src="/resources/testharness.js"></script> 9 <script src="/resources/testharnessreport.js"></script> 10 <script src="/resources/testdriver.js"></script> 11 <script src="/resources/testdriver-vendor.js"></script> 12 <script src="/cookies/resources/cookie-test.js"></script> 13 </head> 14 <body> 15 <div id=log></div> 16 <script> 17 // Tests for control characters (CTLs) in a cookie's value. 18 // CTLs are defined by RFC 5234 to be %x00-1F / %x7F. 19 const CTLS = getCtlCharacters(); 20 21 // All CTLs, with the exception of %x09 (the tab character), should 22 // cause the cookie to be rejected. 23 for (const ctl of CTLS) { 24 if (ctl.code === 0x09) { 25 domCookieTest( 26 `test=${ctl.code}${ctl.chr}value`, 27 `test=${ctl.code}${ctl.chr}value`, 28 `Cookie with %x${ctl.code.toString(16)} in value is accepted (DOM).`); 29 } else { 30 domCookieTest( 31 `test=${ctl.code}${ctl.chr}value`, 32 '', 33 `Cookie with %x${ctl.code.toString(16)} in value is rejected (DOM).`); 34 } 35 } 36 37 // Note that per RFC 9110, %x00, %x0A, and %x0D characters in the HTTP 38 // header MUST either cause the HTTP message to be rejected or be 39 // replaced with %x20 (space) characters. Both cases will result in a 40 // passing test here. For more info, see: 41 // https://www.rfc-editor.org/rfc/rfc9110.html#section-5.5 42 for (const ctl of CTLS) { 43 if (ctl.code === 0x09) { 44 httpCookieTest( 45 `test=${ctl.code}${ctl.chr}value`, 46 `test=${ctl.code}${ctl.chr}value`, 47 `Cookie with %x${ctl.code.toString(16)} in value is accepted (HTTP).`); 48 } else if (ctl.code === 0x00 || ctl.code === 0x0A || ctl.code === 0x0D) { 49 httpCookieTest( 50 `test${ctl.code}${ctl.chr}name=${ctl.code}`, 51 `test${ctl.code} name=${ctl.code}`, 52 `Cookie with %x${ctl.code.toString(16)} in name is rejected or modified (HTTP).`, 53 /* defaultPath */ true, /* allowFetchFailure */ true); 54 } else { 55 httpCookieTest( 56 `test=${ctl.code}${ctl.chr}value`, 57 '', 58 `Cookie with %x${ctl.code.toString(16)} in value is rejected (HTTP).`); 59 } 60 } 61 62 </script> 63 </body> 64 </html>