-
Bug
-
Resolution: Cannot Reproduce
-
Major
-
None
-
2.3.7.Final
-
None
Hello, Undertow 2.3.7 appears to not be able to parse certain RFC-6265 compliant cookie values when receiving a request.
Specifically, the cookie-octet part of Section 4.1.1 allows a character like ?, but when I run a test against the server with a cookie that includes this, the rest of the value gets skipped.
Example cookie: test=foo?bar
What reaches the application: test=foo
I'm using Undertow with Spring Boot 3.1.2 and when using Tomcat this problem does not happen.
Debugging reveals that we enter this if-condition: https://github.com/undertow-io/undertow/blob/2.3.7.Final/core/src/main/java/io/undertow/util/Cookies.java#L309
It looks like I could set allowHttpSepartorsV0 to true, BUT that would also enable characters ; " \ which are explicitly forbidden by RFC-6265.