cookies: reject oversized cookies

Browse source

... instead of truncating them.

There's no fixed limit for acceptable cookie names in RFC 6265, but the
entire cookie is said to be less than 4096 bytes (section 6.1). This is
also what browsers seem to implement.

We now allow max 5000 bytes cookie header. Max 4095 bytes length per
cookie name and value. Name + value together may not exceed 4096 bytes.

Added test 1151 to verify

Bug: https://curl.haxx.se/mail/lib-2017-09/0062.html
Reported-by: Kevin Smith

Closes #1894

...

This commit is contained in:

Daniel Stenberg 2017-09-18 00:55:07 +02:00

parent 1a072796d3

commit 2bc230de63

No known key found for this signature in database

GPG key ID: 5CC908FDB71E12C2

5 changed files with 96 additions and 14 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

4

tests/data/test46

View file

File diff suppressed because one or more lines are too long