Skip to content

Commit c495d5c

Browse files
FagnerMartinsBrackFagnerMartinsBrack
committed
Test for allowed characters in cookie value
1 parent c76131c commit c495d5c

2 files changed

Lines changed: 142 additions & 26 deletions

File tree

‎src/js.cookie.js‎

Lines changed: 7 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
/*global escape: true */
12
/*!
23
* Javascript Cookie v2.0.0-pre
34
* https://github.com/js-cookie/js-cookie
@@ -17,19 +18,6 @@
1718
window.Cookies = factory();
1819
}
1920
}(function () {
20-
var unallowedCharsInName = {
21-
'\\(': '%28',
22-
'\\)': '%29'
23-
};
24-
function encode (value, charmap) {
25-
value = encodeURIComponent(value);
26-
for ( var character in charmap ) {
27-
value = value
28-
.replace(new RegExp(character, 'g'), charmap[character]);
29-
}
30-
return value;
31-
}
32-
3321
function decode (value) {
3422
var matches = value.match(/(%[0-9A-Z]{2})+/g);
3523
while ( matches && matches.length ) {
@@ -94,10 +82,14 @@
9482
}
9583
} catch(e) {}
9684

97-
value = encode(String(value));
85+
value = encodeURIComponent(String(value));
86+
value = value.replace(/%(23|24|26|2B|3A|3C|3E|3D|2F|3F|40|5B|5D|5E|60|7B|7D|7C)/g, decodeURIComponent);
87+
88+
key = encodeURIComponent(String(key));
89+
key = key.replace(/[\(\)]/g, escape);
9890

9991
return (document.cookie = [
100-
encode(key, unallowedCharsInName), '=', value,
92+
key, '=', value,
10193
options.expires && '; expires=' + options.expires.toUTCString(), // use expires attribute, max-age is not supported by IE
10294
options.path && '; path=' + options.path,
10395
options.domain && '; domain=' + options.domain,

‎test/tests.js‎

Lines changed: 135 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -118,16 +118,6 @@ test('Call to read all when there are no cookies at all', function () {
118118
deepEqual(Cookies.get(), {}, 'returns empty object');
119119
});
120120

121-
//github.com/carhartl/jquery-cookie/pull/62
122-
test('provide a way for decoding PHP whitespace encoding', function () {
123-
expect(1);
124-
document.cookie = 'c=foo+bar';
125-
var actual = Cookies.get('c', function (value) {
126-
return value.replace(/\+/g, ' ');
127-
});
128-
strictEqual(actual, 'foo bar', 'should convert pluses back to space');
129-
});
130-
131121
// github.com/carhartl/jquery-cookie/pull/166
132122
test('provide a way for decoding chinese characters', function () {
133123
expect(1);
@@ -237,7 +227,7 @@ test('RFC 6265 - reading cookie-octet enclosed in DQUOTE', function () {
237227
strictEqual(Cookies.get('c'), 'v', 'should decode the quotes');
238228
});
239229

240-
test('RFC 6265 - unallowed characters in cookie-octet', function () {
230+
test('RFC 6265 - unallowed characters in cookie value', function () {
241231
expect(9);
242232

243233
Cookies.set('whitespace', ' ');
@@ -265,6 +255,140 @@ test('RFC 6265 - unallowed characters in cookie-octet', function () {
265255
Cookies.remove('multiple');
266256
});
267257

258+
test('RFC 6265 - sharp is allowed in cookie value', function () {
259+
expect(2);
260+
Cookies.set('c', '#');
261+
strictEqual(Cookies.get('c'), '#', 'should handle the sharp character');
262+
strictEqual(document.cookie, 'c=#', 'sharp is allowed, should not encode');
263+
});
264+
265+
test('RFC 6265 - dollar sign is allowed in cookie value', function () {
266+
expect(2);
267+
Cookies.set('c', '$');
268+
strictEqual(Cookies.get('c'), '$', 'should handle the dollar sign character');
269+
strictEqual(document.cookie, 'c=$', 'dollar sign is allowed, should not encode');
270+
});
271+
272+
test('RFC 6265 - percent is allowed in cookie value', function () {
273+
expect(2);
274+
Cookies.set('c', '%');
275+
strictEqual(Cookies.get('c'), '%', 'should handle the percent character');
276+
strictEqual(document.cookie, 'c=%25', 'percent is allowed, but encode to escape');
277+
});
278+
279+
test('RFC 6265 - ampersand is allowed in cookie value', function () {
280+
expect(2);
281+
Cookies.set('c', '&');
282+
strictEqual(Cookies.get('c'), '&', 'should handle the ampersand character');
283+
strictEqual(document.cookie, 'c=&', 'ampersand is allowed, should not encode');
284+
});
285+
286+
// github.com/carhartl/jquery-cookie/pull/62
287+
test('RFC 6265 - plus is allowed in cookie value', function () {
288+
expect(2);
289+
Cookies.set('c', '+');
290+
strictEqual(Cookies.get('c'), '+', 'should handle the plus character');
291+
strictEqual(document.cookie, 'c=+', 'plus is allowed, should not encode');
292+
});
293+
294+
test('RFC 6265 - colon is allowed in cookie value', function () {
295+
expect(2);
296+
Cookies.set('c', ':');
297+
strictEqual(Cookies.get('c'), ':', 'should handle the colon character');
298+
strictEqual(document.cookie, 'c=:', 'colon is allowed, should not encode');
299+
});
300+
301+
test('RFC 6265 - less-than is allowed in cookie value', function () {
302+
expect(2);
303+
Cookies.set('c', '<');
304+
strictEqual(Cookies.get('c'), '<', 'should handle the less-than character');
305+
strictEqual(document.cookie, 'c=<', 'less-than is allowed, should not encode');
306+
});
307+
308+
test('RFC 6265 - greater-than is allowed in cookie value', function () {
309+
expect(2);
310+
Cookies.set('c', '>');
311+
strictEqual(Cookies.get('c'), '>', 'should handle the greater-than character');
312+
strictEqual(document.cookie, 'c=>', 'greater-than is allowed, should not encode');
313+
});
314+
315+
test('RFC 6265 - equal sign is allowed in cookie value', function () {
316+
expect(2);
317+
Cookies.set('c', '=');
318+
strictEqual(Cookies.get('c'), '=', 'should handle the equal sign character');
319+
strictEqual(document.cookie, 'c==', 'equal sign is allowed, should not encode');
320+
});
321+
322+
test('RFC 6265 - slash is allowed in cookie value', function () {
323+
expect(2);
324+
Cookies.set('c', '/');
325+
strictEqual(Cookies.get('c'), '/', 'should handle the slash character');
326+
strictEqual(document.cookie, 'c=/', 'slash is allowed, should not encode');
327+
});
328+
329+
test('RFC 6265 - question mark is allowed in cookie value', function () {
330+
expect(2);
331+
Cookies.set('c', '?');
332+
strictEqual(Cookies.get('c'), '?', 'should handle the question mark character');
333+
strictEqual(document.cookie, 'c=?', 'question mark is allowed, should not encode');
334+
});
335+
336+
test('RFC 6265 - at is allowed in cookie value', function () {
337+
expect(2);
338+
Cookies.set('c', '@');
339+
strictEqual(Cookies.get('c'), '@', 'should handle the at character');
340+
strictEqual(document.cookie, 'c=@', 'at is allowed, should not encode');
341+
});
342+
343+
test('RFC 6265 - opening square bracket is allowed in cookie value', function () {
344+
expect(2);
345+
Cookies.set('c', '[');
346+
strictEqual(Cookies.get('c'), '[', 'should handle the opening square bracket character');
347+
strictEqual(document.cookie, 'c=[', 'opening square bracket is allowed, should not encode');
348+
});
349+
350+
test('RFC 6265 - closing square bracket is allowed in cookie value', function () {
351+
expect(2);
352+
Cookies.set('c', ']');
353+
strictEqual(Cookies.get('c'), ']', 'should handle the closing square bracket character');
354+
strictEqual(document.cookie, 'c=]', 'closing square bracket is allowed, should not encode');
355+
});
356+
357+
test('RFC 6265 - caret is allowed in cookie value', function () {
358+
expect(2);
359+
Cookies.set('c', '^');
360+
strictEqual(Cookies.get('c'), '^', 'should handle the caret character');
361+
strictEqual(document.cookie, 'c=^', 'caret is allowed, should not encode');
362+
});
363+
364+
test('RFC 6265 - grave accent is allowed in cookie value', function () {
365+
expect(2);
366+
Cookies.set('c', '`');
367+
strictEqual(Cookies.get('c'), '`', 'should handle the grave accent character');
368+
strictEqual(document.cookie, 'c=`', 'grave accent is allowed, should not encode');
369+
});
370+
371+
test('RFC 6265 - opening curly bracket is allowed in cookie value', function () {
372+
expect(2);
373+
Cookies.set('c', '{');
374+
strictEqual(Cookies.get('c'), '{', 'should handle the opening curly bracket character');
375+
strictEqual(document.cookie, 'c={', 'opening curly bracket is allowed, should not encode');
376+
});
377+
378+
test('RFC 6265 - closing curly bracket is allowed in cookie value', function () {
379+
expect(2);
380+
Cookies.set('c', '}');
381+
strictEqual(Cookies.get('c'), '}', 'should handle the closing curly bracket character');
382+
strictEqual(document.cookie, 'c=}', 'closing curly bracket is allowed, should not encode');
383+
});
384+
385+
test('RFC 6265 - pipe is allowed in cookie value', function () {
386+
expect(2);
387+
Cookies.set('c', '|');
388+
strictEqual(Cookies.get('c'), '|', 'should handle the pipe character');
389+
strictEqual(document.cookie, 'c=|', 'pipe is allowed, should not encode');
390+
});
391+
268392
test('RFC 6265 - unallowed characters in cookie-name', function () {
269393
expect(38);
270394

0 commit comments

Comments
 (0)