Fix incorrectly disallowing equals sign in cookie value

pillarjs · Jan 2, 2024 · 0458556 · 0458556 · fengmk2 · Jan 2, 2024
1 parent 62b4701
commit 0458556
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 4 deletions.
diff --git a/HISTORY.md b/HISTORY.md
@@ -1,3 +1,8 @@
+unreleased
+==========
+
+  * Fix incorrectly disallowing equals sign in cookie value
+
 0.9.0 / 2023-12-28
 ==================
 

diff --git a/index.js b/index.js
@@ -40,10 +40,16 @@ var REGEXP_CACHE = Object.create(null)
 var REGEXP_ESCAPE_CHARS_REGEXP = /[\^$\\.*+?()[\]{}|]/g
 
 /**
- * RegExp to match basic restricted characters for loose validation.
+ * RegExp to match basic restricted name characters for loose validation.
  */
 
-var RESTRICTED_CHARS_REGEXP = /[;=]/
+var RESTRICTED_NAME_CHARS_REGEXP = /[;=]/
+
+/**
+ * RegExp to match basic restricted value characters for loose validation.
+ */
+
+var RESTRICTED_VALUE_CHARS_REGEXP = /[;]/
 
 /**
  * RegExp to match Same-Site cookie attribute value.
@@ -144,11 +150,11 @@ Cookies.prototype.set = function(name, value, opts) {
 };
 
 function Cookie(name, value, attrs) {
-  if (!fieldContentRegExp.test(name) || RESTRICTED_CHARS_REGEXP.test(name)) {
+  if (!fieldContentRegExp.test(name) || RESTRICTED_NAME_CHARS_REGEXP.test(name)) {
     throw new TypeError('argument name is invalid');
   }
 
-  if (value && (!fieldContentRegExp.test(value) || RESTRICTED_CHARS_REGEXP.test(value))) {
+  if (value && (!fieldContentRegExp.test(value) || RESTRICTED_VALUE_CHARS_REGEXP.test(value))) {
     throw new TypeError('argument value is invalid');
   }