From d478199ada6979ddb3f3f861dd86a4194c49a257 Mon Sep 17 00:00:00 2001 From: nnposter Date: Sat, 29 Apr 2017 14:36:46 +0000 Subject: [PATCH] Allows cookies to have unrecognized attributes (see RFC 6265, Section 5.2). Fixes #866 --- CHANGELOG | 4 ++++ nselib/http.lua | 3 ++- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/CHANGELOG b/CHANGELOG index 788f8e822..90f8597f6 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -24,6 +24,10 @@ o [NSE] The HTTP response object has a new member, fragment, which contains a partially received body (if any) when the overall request fails to complete. [nnposter] +o [NSE][GH#866] NSE now allows cookies to have arbitrary attributes, which + are silently ignored (in accordance with RFC 6265). Unrecognized attributes + were previously causing HTTP requests with such cookies to fail. [nnposter] + o [NSE][GH#844] NSE now correctly parses a Set-Cookie header that has unquoted whitespace in the cookie value (which is allowed per RFC 6265). [nnposter] diff --git a/nselib/http.lua b/nselib/http.lua index 4560912b0..b49da424e 100644 --- a/nselib/http.lua +++ b/nselib/http.lua @@ -318,7 +318,8 @@ local function validate_options(options) end elseif not (cookie_key == 'httponly' or cookie_key == 'secure') then stdnse.debug1("http: Unknown field in cookie table: %s", cookie_key) - bad = true + -- Ignore unrecognized attributes (per RFC 6265, Section 5.2) + -- bad = true end end end