diff options
| author | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-19 00:47:55 +0000 |
|---|---|---|
| committer | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-19 00:47:55 +0000 |
| commit | 26a029d407be480d791972afb5975cf62c9360a6 (patch) | |
| tree | f435a8308119effd964b339f76abb83a57c29483 /testing/web-platform/tests/cookies/value | |
| parent | Initial commit. (diff) | |
| download | firefox-26a029d407be480d791972afb5975cf62c9360a6.tar.xz firefox-26a029d407be480d791972afb5975cf62c9360a6.zip | |
Adding upstream version 124.0.1.upstream/124.0.1
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to 'testing/web-platform/tests/cookies/value')
| -rw-r--r-- | testing/web-platform/tests/cookies/value/value-ctl.html | 64 | ||||
| -rw-r--r-- | testing/web-platform/tests/cookies/value/value.html | 170 |
2 files changed, 234 insertions, 0 deletions
diff --git a/testing/web-platform/tests/cookies/value/value-ctl.html b/testing/web-platform/tests/cookies/value/value-ctl.html new file mode 100644 index 0000000000..5a24064f43 --- /dev/null +++ b/testing/web-platform/tests/cookies/value/value-ctl.html @@ -0,0 +1,64 @@ +<!doctype html> +<html> + <head> + <meta charset=utf-8> + <title>Test cookie value parsing with control characters</title> + <meta name=help href="https://tools.ietf.org/html/rfc6265#section-5.2"> + <meta name="timeout" content="long"> + <script src="/resources/testharness.js"></script> + <script src="/resources/testharnessreport.js"></script> + <script src="/resources/testdriver.js"></script> + <script src="/resources/testdriver-vendor.js"></script> + <script src="/cookies/resources/cookie-test.js"></script> + </head> + <body> + <div id=log></div> + <script> + // Tests for control characters (CTLs) in a cookie's value. + // CTLs are defined by RFC 5234 to be %x00-1F / %x7F. + const CTLS = getCtlCharacters(); + + // All CTLs, with the exception of %x09 (the tab character), should + // cause the cookie to be rejected. + for (const ctl of CTLS) { + if (ctl.code === 0x09) { + domCookieTest( + `test=${ctl.code}${ctl.chr}value`, + `test=${ctl.code}${ctl.chr}value`, + `Cookie with %x${ctl.code.toString(16)} in value is accepted (DOM).`); + } else { + domCookieTest( + `test=${ctl.code}${ctl.chr}value`, + '', + `Cookie with %x${ctl.code.toString(16)} in value is rejected (DOM).`); + } + } + + // Note that per RFC 9110, %x00, %x0A, and %x0D characters in the HTTP + // header MUST either cause the HTTP message to be rejected or be + // replaced with %x20 (space) characters. Both cases will result in a + // passing test here. For more info, see: + // https://www.rfc-editor.org/rfc/rfc9110.html#section-5.5 + for (const ctl of CTLS) { + if (ctl.code === 0x09) { + httpCookieTest( + `test=${ctl.code}${ctl.chr}value`, + `test=${ctl.code}${ctl.chr}value`, + `Cookie with %x${ctl.code.toString(16)} in value is accepted (HTTP).`); + } else if (ctl.code === 0x00 || ctl.code === 0x0A || ctl.code === 0x0D) { + httpCookieTest( + `test${ctl.code}${ctl.chr}name=${ctl.code}`, + `test${ctl.code} name=${ctl.code}`, + `Cookie with %x${ctl.code.toString(16)} in name is rejected or modified (HTTP).`, + /* defaultPath */ true, /* allowFetchFailure */ true); + } else { + httpCookieTest( + `test=${ctl.code}${ctl.chr}value`, + '', + `Cookie with %x${ctl.code.toString(16)} in value is rejected (HTTP).`); + } + } + + </script> + </body> +</html> diff --git a/testing/web-platform/tests/cookies/value/value.html b/testing/web-platform/tests/cookies/value/value.html new file mode 100644 index 0000000000..14292cece9 --- /dev/null +++ b/testing/web-platform/tests/cookies/value/value.html @@ -0,0 +1,170 @@ +<!doctype html> +<html> + <head> + <meta charset=utf-8> + <title>Test cookie value parsing</title> + <meta name=help href="https://tools.ietf.org/html/rfc6265#section-5.2"> + <meta name="timeout" content="long"> + <script src="/resources/testharness.js"></script> + <script src="/resources/testharnessreport.js"></script> + <script src="/resources/testdriver.js"></script> + <script src="/resources/testdriver-vendor.js"></script> + <script src="/cookies/resources/cookie-test.js"></script> + </head> + <body> + <div id=log></div> + <script> + // TODO: there is more to test here, these tests capture the old + // ported http-state tests. Feel free to delete this comment when more + // are added, or these are split up into logical groups. + const valueTests = [ + { + cookie: "test=1, baz=qux", + expected: "test=1, baz=qux", + name: "Set value containing a comma", + }, + { + cookie: 'test="2, baz=qux"', + expected: 'test="2, baz=qux"', + name: "Set quoted value containing a comma", + }, + { + cookie: 'test="3zz;pp" ; ;', + expected: 'test="3zz', + name: "Ignore values after semicolon", + }, + { + cookie: 'test="4zz ;', + expected: 'test="4zz', + name: "Ignore whitespace at the end of value", + }, + { + cookie: 'test="5zzz " "ppp" ;', + expected: 'test="5zzz " "ppp"', + name: "Set value including quotes and whitespace up until semicolon", + }, + { + cookie: 'test=6A"B ;', + expected: 'test=6A"B', + name: "Set value with a single quote excluding whitespace" + }, + { + cookie: "test7", + expected: "test7", + name: "Set nameless cookie to its value", + }, + { + cookie: '"test8\"HHH"', + expected: '"test8\"HHH"', + name: "Set nameless cookie to its value with an escaped quote", + }, + { + cookie: 'test="9', + expected: 'test="9', + name: "Set value with unbalanced leading quote", + }, + { + cookie: "=test10", + expected: "test10", + name: "Set nameless cookie followed by '=' to its value", + }, + { + // 4 + 2 + 4090 = 4096 + cookie: `test=11${"a".repeat(4090)}`, + expected: `test=11${"a".repeat(4090)}`, + name: "Set cookie with large name + value ( = 4kb)", + }, + { + // 4 + 2 + 4091 = 4097 + cookie: `test=12${"a".repeat(4091)}`, + expected: "", + name: "Ignore cookie with large name + value ( > 4kb)", + }, + { + cookie: `test=13\nZYX`, + expected: "test=13", + name: "Set cookie but ignore value after LF", + }, + { + cookie: 'test="14 " ;', + expected: 'test="14 "', + name: "Set cookie ignoring whitespace after value endquote", + }, + { + cookie: "test=15 ;", + expected: "test=15", + name: "Ignore whitespace and ; after value", + }, + { + cookie: "test= 16", + expected: "test=16", + name: "Ignore whitespace preceding value", + }, + { + cookie: 'test="17"', + expected: 'test="17"', + name: "Set cookie with quotes in value", + }, + { + cookie: 'test=" 18 "', + expected: 'test=" 18 "', + name: "Set cookie keeping whitespace inside quoted value", + }, + { + cookie: 'test="19;wow"', + expected: 'test="19', + name: "Set cookie value ignoring characters after semicolon", + }, + { + cookie: 'test="20=20"', + expected: 'test="20=20"', + name: "Set cookie with another = inside quoted value", + }, + { + cookie: "test = 21 ; ttt", + expected: "test=21", + name: "Set cookie ignoring whitespace surrounding value and characters after first semicolon", + }, + { + cookie: ["testA=22", "test22=", "testB=22"], + expected: "testA=22; test22=; testB=22", + name: "Set valueless cookie, given `Set-Cookie: test22=`", + }, + { + cookie: "test=%32%33", + expected: "test=%32%33", + name: "URL-encoded cookie value is not decoded", + }, + { + cookie: "test24==", + expected: "test24==", + name: "Set cookie with value set to =", + }, + { + cookie: 'test=25=25', + expected: 'test=25=25', + name: "Set cookie with one = inside an unquoted value", + }, + { + cookie: 'test=26=26=26', + expected: 'test=26=26=26', + name: "Set cookie with two = inside an unquoted value", + }, + { + cookie: 'test=27 test', + expected: 'test=27 test', + name: "Set cookie with a space character in the value", + }, + { + cookie: ' test test28 ;', + expected: 'test test28', + name: "Set a nameless cookie with a space character in the value", + }, + ]; + + for (const test of valueTests) { + httpCookieTest(test.cookie, test.expected, test.name, test.defaultPath); + } + </script> + </body> +</html> |