Skip to content

session cookie not robust. #763

@goulf-3m

Description

@goulf-3m

Describe the bug
My android browser tend to add quotes to session cookie.
In Genie, it decrypt without striping the quotes, and then throws.

Error stacktrace

│ Stacktrace:
│   [1] number_from_hex
│     @ ./strings/util.jl:1190 [inlined]
│   [2] hex2bytes!(dest::Vector{UInt8}, itr::Base.CodeUnits{UInt8, String})
│     @ Base ./strings/util.jl:1178
│   [3] hex2bytes!
│     @ ./strings/util.jl:1153 [inlined]
│   [4] hex2bytes
│     @ ./strings/util.jl:1147 [inlined]
│   [5] |>
│     @ ./operators.jl:972 [inlined]
│   [6] decrypt(s::String)
│     @ Genie.Encryption ~/.julia/packages/Genie/0FY0g/src/Encryption.jl:32
│   [7] nullablevalue(payload::HTTP.Messages.Request, key::String; encrypted::Bool)
│     @ Genie.Cookies ~/.julia/packages/Genie/0FY0g/src/Cookies.jl:151
│   [8] nullablevalue
│     @ ~/.julia/packages/Genie/0FY0g/src/Cookies.jl:145 [inlined]
│   [9] get(req::HTTP.Messages.Request, key::String; encrypted::Bool)
│     @ Genie.Cookies ~/.julia/packages/Genie/0FY0g/src/Cookies.jl:56
│  [10] get
│     @ ~/.julia/packages/Genie/0FY0g/src/Cookies.jl:55 [inlined]
│  [11] id(req::HTTP.Messages.Request, res::HTTP.Messages.Response)
│     @ GenieSession ~/.julia/packages/GenieSession/Kmjen/src/GenieSession.jl:101

To reproduce
Always reproducable with my android phone.

Expected behavior
It should not throw.

Additional context
not necessary

In the nullablevalue function, the following fixes this issue:

if length(value)>=2 && value[1] == '"' && value[end] == '"'
value=value[2:end-1]
end

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions