41 lines
1.5 KiB
TypeScript
41 lines
1.5 KiB
TypeScript
import { describe, expect, it } from 'bun:test';
|
|
import { parseCookieHeader, safeDecode } from '../src/lib/utils/cookie-parse';
|
|
|
|
describe('parseCookieHeader resilience (#1224)', () => {
|
|
it('decodes well-formed percent-encoded values', () => {
|
|
const out = parseCookieHeader('foo=hello%20world; bar=a%2Bb');
|
|
expect(out.foo).toBe('hello world');
|
|
expect(out.bar).toBe('a+b');
|
|
});
|
|
|
|
it('does not throw on a malformed value — falls back to raw', () => {
|
|
// `%E0%A4%A` is truncated; decodeURIComponent throws URIError on it.
|
|
// Real-world reproducer: stray `%` from a third-party tracker cookie
|
|
// that hitchhiked into the WS upgrade and crashed terminal exec.
|
|
const out = parseCookieHeader('session=valid-token; bad=%E0%A4%A');
|
|
expect(out.session).toBe('valid-token');
|
|
expect(out.bad).toBe('%E0%A4%A');
|
|
});
|
|
|
|
it('does not throw on a bare lonely percent', () => {
|
|
const out = parseCookieHeader('session=valid; weird=100%');
|
|
expect(out.session).toBe('valid');
|
|
expect(out.weird).toBe('100%');
|
|
});
|
|
|
|
it('strips surrounding double quotes', () => {
|
|
const out = parseCookieHeader('foo="quoted-value"');
|
|
expect(out.foo).toBe('quoted-value');
|
|
});
|
|
|
|
it('returns empty object for undefined or empty header', () => {
|
|
expect(parseCookieHeader(undefined)).toEqual({});
|
|
expect(parseCookieHeader('')).toEqual({});
|
|
});
|
|
|
|
it('safeDecode returns input on URIError', () => {
|
|
expect(safeDecode('%E0%A4%A')).toBe('%E0%A4%A');
|
|
expect(safeDecode('hello%20world')).toBe('hello world');
|
|
});
|
|
});
|