{"action":"created","comment":{"url":"https://api.github.com/repos/netty/netty/pulls/comments/28397338","id":28397338,"diff_hunk":"@@ -157,20 +119,48 @@\n                     if (i == headerLen) {\n                         // NAME (no value till the end of string)\n                         newNameEnd = headerLen;\n-                        value = null;\n+                        newValueStart = newValueEnd = -1;\n                         break;\n                     }\n                 }\n             }\n \n-            if (!rfc2965Style || (!header.regionMatches(newNameStart, \"$Path\", 0, \"$Path\".length()) &&\n-                    !header.regionMatches(newNameStart, \"$Domain\", 0, \"$Domain\".length()) &&\n-                    !header.regionMatches(newNameStart, \"$Port\", 0, \"$Port\".length()))) {\n+            if (newValueStart == -1) {\n+                LOGGER.debug(\"Skipping cookie with null value\");\n+                continue;\n+            }\n+\n+            if (rfc2965Style && (header.regionMatches(newNameStart, \"$Path\", 0, \"$Path\".length()) ||\n+                    header.regionMatches(newNameStart, \"$Domain\", 0, \"$Domain\".length()) ||\n+                    header.regionMatches(newNameStart, \"$Port\", 0, \"$Port\".length()))) {\n \n                 // skip obsolete RFC2965 fields\n-                String name = header.substring(newNameStart, newNameEnd);\n-                cookies.add(new DefaultCookie(name, value));\n+                continue;\n             }\n+\n+            if (containsInvalidCookieNameOctet(header, newNameStart, newNameEnd)) {\n+                LOGGER.debug(\"Skipping cookie because name contains an invalid char\");","path":"codec-http/src/main/java/io/netty/handler/codec/http/ServerCookieDecoder.java","position":144,"original_position":144,"commit_id":"67b40541f2c760a20c78fde4ca85f521f3efb7d0","original_commit_id":"67b40541f2c760a20c78fde4ca85f521f3efb7d0","user":{"login":"trustin","id":173918,"avatar_url":"https://avatars.githubusercontent.com/u/173918?v=3","gravatar_id":"","url":"https://api.github.com/users/trustin","html_url":"https://github.com/trustin","followers_url":"https://api.github.com/users/trustin/followers","following_url":"https://api.github.com/users/trustin/following{/other_user}","gists_url":"https://api.github.com/users/trustin/gists{/gist_id}","starred_url":"https://api.github.com/users/trustin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/trustin/subscriptions","organizations_url":"https://api.github.com/users/trustin/orgs","repos_url":"https://api.github.com/users/trustin/repos","events_url":"https://api.github.com/users/trustin/events{/privacy}","received_events_url":"https://api.github.com/users/trustin/received_events","type":"User","site_admin":false},"body":"This will lead to two log messages because `containsInvalidOctet()` also does logging.  Could we make logging occurs only once?","created_at":"2015-04-15T06:57:53Z","updated_at":"2015-04-15T06:57:53Z","html_url":"https://github.com/netty/netty/pull/3629#discussion_r28397338","pull_request_url":"https://api.github.com/repos/netty/netty/pulls/3629","_links":{"self":{"href":"https://api.github.com/repos/netty/netty/pulls/comments/28397338"},"html":{"href":"https://github.com/netty/netty/pull/3629#discussion_r28397338"},"pull_request":{"href":"https://api.github.com/repos/netty/netty/pulls/3629"}}},"pull_request":{"url":"https://api.github.com/repos/netty/netty/pulls/3629","id":33251452,"html_url":"https://github.com/netty/netty/pull/3629","diff_url":"https://github.com/netty/netty/pull/3629.diff","patch_url":"https://github.com/netty/netty/pull/3629.patch","issue_url":"https://api.github.com/repos/netty/netty/issues/3629","number":3629,"state":"open","locked":false,"title":"Validate cookie name and value characters","user":{"login":"slandelle","id":849197,"avatar_url":"https://avatars.githubusercontent.com/u/849197?v=3","gravatar_id":"","url":"https://api.github.com/users/slandelle","html_url":"https://github.com/slandelle","followers_url":"https://api.github.com/users/slandelle/followers","following_url":"https://api.github.com/users/slandelle/following{/other_user}","gists_url":"https://api.github.com/users/slandelle/gists{/gist_id}","starred_url":"https://api.github.com/users/slandelle/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/slandelle/subscriptions","organizations_url":"https://api.github.com/users/slandelle/orgs","repos_url":"https://api.github.com/users/slandelle/repos","events_url":"https://api.github.com/users/slandelle/events{/privacy}","received_events_url":"https://api.github.com/users/slandelle/received_events","type":"User","site_admin":false},"body":"Motivation:\r\n\r\nRFC6265 specifies which characters are allowed in a cookie name and value.\r\n\r\nNetty is currently too lax, which can used for HttpOnly escaping.\r\n\r\nModification:\r\n\r\nIn ServerCookieDecoder: discard cookie key-value pairs that contain invalid characters.\r\nIn ClientCookieEncoder: throw an exception when trying to encode cookies with invalid characters.\r\n\r\nResult:\r\n\r\nThe problem described in the motivation section is fixed.","created_at":"2015-04-14T12:17:01Z","updated_at":"2015-04-15T06:57:53Z","closed_at":null,"merged_at":null,"merge_commit_sha":"f395ccd752ae920da9903e3fbb07951785137a7c","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/netty/netty/pulls/3629/commits","review_comments_url":"https://api.github.com/repos/netty/netty/pulls/3629/comments","review_comment_url":"https://api.github.com/repos/netty/netty/pulls/comments{/number}","comments_url":"https://api.github.com/repos/netty/netty/issues/3629/comments","statuses_url":"https://api.github.com/repos/netty/netty/statuses/67b40541f2c760a20c78fde4ca85f521f3efb7d0","head":{"label":"slandelle:cookie-parsing","ref":"cookie-parsing","sha":"67b40541f2c760a20c78fde4ca85f521f3efb7d0","user":{"login":"slandelle","id":849197,"avatar_url":"https://avatars.githubusercontent.com/u/849197?v=3","gravatar_id":"","url":"https://api.github.com/users/slandelle","html_url":"https://github.com/slandelle","followers_url":"https://api.github.com/users/slandelle/followers","following_url":"https://api.github.com/users/slandelle/following{/other_user}","gists_url":"https://api.github.com/users/slandelle/gists{/gist_id}","starred_url":"https://api.github.com/users/slandelle/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/slandelle/subscriptions","organizations_url":"https://api.github.com/users/slandelle/orgs","repos_url":"https://api.github.com/users/slandelle/repos","events_url":"https://api.github.com/users/slandelle/events{/privacy}","received_events_url":"https://api.github.com/users/slandelle/received_events","type":"User","site_admin":false},"repo":{"id":33929023,"name":"netty","full_name":"slandelle/netty","owner":{"login":"slandelle","id":849197,"avatar_url":"https://avatars.githubusercontent.com/u/849197?v=3","gravatar_id":"","url":"https://api.github.com/users/slandelle","html_url":"https://github.com/slandelle","followers_url":"https://api.github.com/users/slandelle/followers","following_url":"https://api.github.com/users/slandelle/following{/other_user}","gists_url":"https://api.github.com/users/slandelle/gists{/gist_id}","starred_url":"https://api.github.com/users/slandelle/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/slandelle/subscriptions","organizations_url":"https://api.github.com/users/slandelle/orgs","repos_url":"https://api.github.com/users/slandelle/repos","events_url":"https://api.github.com/users/slandelle/events{/privacy}","received_events_url":"https://api.github.com/users/slandelle/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/slandelle/netty","description":"Netty project - an event-driven asynchronous network application framework","fork":true,"url":"https://api.github.com/repos/slandelle/netty","forks_url":"https://api.github.com/repos/slandelle/netty/forks","keys_url":"https://api.github.com/repos/slandelle/netty/keys{/key_id}","collaborators_url":"https://api.github.com/repos/slandelle/netty/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/slandelle/netty/teams","hooks_url":"https://api.github.com/repos/slandelle/netty/hooks","issue_events_url":"https://api.github.com/repos/slandelle/netty/issues/events{/number}","events_url":"https://api.github.com/repos/slandelle/netty/events","assignees_url":"https://api.github.com/repos/slandelle/netty/assignees{/user}","branches_url":"https://api.github.com/repos/slandelle/netty/branches{/branch}","tags_url":"https://api.github.com/repos/slandelle/netty/tags","blobs_url":"https://api.github.com/repos/slandelle/netty/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/slandelle/netty/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/slandelle/netty/git/refs{/sha}","trees_url":"https://api.github.com/repos/slandelle/netty/git/trees{/sha}","statuses_url":"https://api.github.com/repos/slandelle/netty/statuses/{sha}","languages_url":"https://api.github.com/repos/slandelle/netty/languages","stargazers_url":"https://api.github.com/repos/slandelle/netty/stargazers","contributors_url":"https://api.github.com/repos/slandelle/netty/contributors","subscribers_url":"https://api.github.com/repos/slandelle/netty/subscribers","subscription_url":"https://api.github.com/repos/slandelle/netty/subscription","commits_url":"https://api.github.com/repos/slandelle/netty/commits{/sha}","git_commits_url":"https://api.github.com/repos/slandelle/netty/git/commits{/sha}","comments_url":"https://api.github.com/repos/slandelle/netty/comments{/number}","issue_comment_url":"https://api.github.com/repos/slandelle/netty/issues/comments{/number}","contents_url":"https://api.github.com/repos/slandelle/netty/contents/{+path}","compare_url":"https://api.github.com/repos/slandelle/netty/compare/{base}...{head}","merges_url":"https://api.github.com/repos/slandelle/netty/merges","archive_url":"https://api.github.com/repos/slandelle/netty/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/slandelle/netty/downloads","issues_url":"https://api.github.com/repos/slandelle/netty/issues{/number}","pulls_url":"https://api.github.com/repos/slandelle/netty/pulls{/number}","milestones_url":"https://api.github.com/repos/slandelle/netty/milestones{/number}","notifications_url":"https://api.github.com/repos/slandelle/netty/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/slandelle/netty/labels{/name}","releases_url":"https://api.github.com/repos/slandelle/netty/releases{/id}","created_at":"2015-04-14T11:58:26Z","updated_at":"2015-04-14T11:58:34Z","pushed_at":"2015-04-14T13:18:37Z","git_url":"git://github.com/slandelle/netty.git","ssh_url":"git@github.com:slandelle/netty.git","clone_url":"https://github.com/slandelle/netty.git","svn_url":"https://github.com/slandelle/netty","homepage":"http://netty.io/","size":41303,"stargazers_count":0,"watchers_count":0,"language":"Java","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"netty:4.1","ref":"4.1","sha":"0d9ba81c061f75bb1cf64dfb5c739a1fa0dd5775","user":{"login":"netty","id":473791,"avatar_url":"https://avatars.githubusercontent.com/u/473791?v=3","gravatar_id":"","url":"https://api.github.com/users/netty","html_url":"https://github.com/netty","followers_url":"https://api.github.com/users/netty/followers","following_url":"https://api.github.com/users/netty/following{/other_user}","gists_url":"https://api.github.com/users/netty/gists{/gist_id}","starred_url":"https://api.github.com/users/netty/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/netty/subscriptions","organizations_url":"https://api.github.com/users/netty/orgs","repos_url":"https://api.github.com/users/netty/repos","events_url":"https://api.github.com/users/netty/events{/privacy}","received_events_url":"https://api.github.com/users/netty/received_events","type":"Organization","site_admin":false},"repo":{"id":1064563,"name":"netty","full_name":"netty/netty","owner":{"login":"netty","id":473791,"avatar_url":"https://avatars.githubusercontent.com/u/473791?v=3","gravatar_id":"","url":"https://api.github.com/users/netty","html_url":"https://github.com/netty","followers_url":"https://api.github.com/users/netty/followers","following_url":"https://api.github.com/users/netty/following{/other_user}","gists_url":"https://api.github.com/users/netty/gists{/gist_id}","starred_url":"https://api.github.com/users/netty/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/netty/subscriptions","organizations_url":"https://api.github.com/users/netty/orgs","repos_url":"https://api.github.com/users/netty/repos","events_url":"https://api.github.com/users/netty/events{/privacy}","received_events_url":"https://api.github.com/users/netty/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/netty/netty","description":"Netty project - an event-driven asynchronous network application framework","fork":false,"url":"https://api.github.com/repos/netty/netty","forks_url":"https://api.github.com/repos/netty/netty/forks","keys_url":"https://api.github.com/repos/netty/netty/keys{/key_id}","collaborators_url":"https://api.github.com/repos/netty/netty/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/netty/netty/teams","hooks_url":"https://api.github.com/repos/netty/netty/hooks","issue_events_url":"https://api.github.com/repos/netty/netty/issues/events{/number}","events_url":"https://api.github.com/repos/netty/netty/events","assignees_url":"https://api.github.com/repos/netty/netty/assignees{/user}","branches_url":"https://api.github.com/repos/netty/netty/branches{/branch}","tags_url":"https://api.github.com/repos/netty/netty/tags","blobs_url":"https://api.github.com/repos/netty/netty/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/netty/netty/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/netty/netty/git/refs{/sha}","trees_url":"https://api.github.com/repos/netty/netty/git/trees{/sha}","statuses_url":"https://api.github.com/repos/netty/netty/statuses/{sha}","languages_url":"https://api.github.com/repos/netty/netty/languages","stargazers_url":"https://api.github.com/repos/netty/netty/stargazers","contributors_url":"https://api.github.com/repos/netty/netty/contributors","subscribers_url":"https://api.github.com/repos/netty/netty/subscribers","subscription_url":"https://api.github.com/repos/netty/netty/subscription","commits_url":"https://api.github.com/repos/netty/netty/commits{/sha}","git_commits_url":"https://api.github.com/repos/netty/netty/git/commits{/sha}","comments_url":"https://api.github.com/repos/netty/netty/comments{/number}","issue_comment_url":"https://api.github.com/repos/netty/netty/issues/comments{/number}","contents_url":"https://api.github.com/repos/netty/netty/contents/{+path}","compare_url":"https://api.github.com/repos/netty/netty/compare/{base}...{head}","merges_url":"https://api.github.com/repos/netty/netty/merges","archive_url":"https://api.github.com/repos/netty/netty/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/netty/netty/downloads","issues_url":"https://api.github.com/repos/netty/netty/issues{/number}","pulls_url":"https://api.github.com/repos/netty/netty/pulls{/number}","milestones_url":"https://api.github.com/repos/netty/netty/milestones{/number}","notifications_url":"https://api.github.com/repos/netty/netty/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/netty/netty/labels{/name}","releases_url":"https://api.github.com/repos/netty/netty/releases{/id}","created_at":"2010-11-09T09:22:21Z","updated_at":"2015-04-15T06:54:37Z","pushed_at":"2015-04-15T06:40:11Z","git_url":"git://github.com/netty/netty.git","ssh_url":"git@github.com:netty/netty.git","clone_url":"https://github.com/netty/netty.git","svn_url":"https://github.com/netty/netty","homepage":"http://netty.io/","size":116804,"stargazers_count":4416,"watchers_count":4416,"language":"Java","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":2175,"mirror_url":null,"open_issues_count":248,"forks":2175,"open_issues":248,"watchers":4416,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/netty/netty/pulls/3629"},"html":{"href":"https://github.com/netty/netty/pull/3629"},"issue":{"href":"https://api.github.com/repos/netty/netty/issues/3629"},"comments":{"href":"https://api.github.com/repos/netty/netty/issues/3629/comments"},"review_comments":{"href":"https://api.github.com/repos/netty/netty/pulls/3629/comments"},"review_comment":{"href":"https://api.github.com/repos/netty/netty/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/netty/netty/pulls/3629/commits"},"statuses":{"href":"https://api.github.com/repos/netty/netty/statuses/67b40541f2c760a20c78fde4ca85f521f3efb7d0"}}}}