[PATCH] When parsing cookies, only decode the values

Gbp-Pq: Name CVE-2021-41819.patch

diff --git a/lib/cgi/cookie.rb b/lib/cgi/cookie.rb
index ffd88b8edb0dccff9bd2668bc219a2be3711c912..66a3feeabc921751d8642ce99d532d7f7b989765 100644 (file)
--- a/lib/cgi/cookie.rb
+++ b/lib/cgi/cookie.rb
@@ -165,7 +165,6 @@ class CGI
       raw_cookie.split(/[;,]\s?/).each do |pairs|
         name, values = pairs.split('=',2)
         next unless name and values
-        name = CGI.unescape(name)
         values ||= ""
         values = values.split('&').collect{|v| CGI.unescape(v,@@accept_charset) }
         if cookies.has_key?(name)

diff --git a/test/cgi/test_cgi_cookie.rb b/test/cgi/test_cgi_cookie.rb
index ae7b14a4ddd7198604f400cdf97c4fd4ffe202b1..e7788fe065fb8a3c6969711c7bf685638262fdc6 100644 (file)
--- a/test/cgi/test_cgi_cookie.rb
+++ b/test/cgi/test_cgi_cookie.rb
@@ -98,6 +98,11 @@ class CGICookieTest < Test::Unit::TestCase
     end
   end
 
+  def test_cgi_cookie_parse_not_decode_name
+    cookie_str = "%66oo=baz;foo=bar"
+    cookies = CGI::Cookie.parse(cookie_str)
+    assert_equal({"%66oo" => ["baz"], "foo" => ["bar"]}, cookies)
+  end
 
   def test_cgi_cookie_arrayinterface
     cookie = CGI::Cookie.new('name1', 'a', 'b', 'c')