diff --git a/lib/web/cookies/parse.js b/lib/web/cookies/parse.js index 51854822a8b..da7454dda02 100644 --- a/lib/web/cookies/parse.js +++ b/lib/web/cookies/parse.js @@ -189,14 +189,16 @@ function parseUnparsedAttributes (unparsedAttributes, cookieAttributeList = {}) // 1. If the first character of the attribute-value is not a DIGIT or a // "-" character, ignore the cookie-av. const charCode = attributeValue.charCodeAt(0) + const startsWithDigit = charCode >= 48 && charCode <= 57 + const startsWithSignedDigit = attributeValue[0] === '-' && attributeValue.length > 1 - if ((charCode < 48 || charCode > 57) && attributeValue[0] !== '-') { + if (!startsWithDigit && !startsWithSignedDigit) { return parseUnparsedAttributes(unparsedAttributes, cookieAttributeList) } // 2. If the remainder of attribute-value contains a non-DIGIT // character, ignore the cookie-av. - if (!/^\d+$/.test(attributeValue)) { + if (/[^\d]/.test(attributeValue.slice(1))) { return parseUnparsedAttributes(unparsedAttributes, cookieAttributeList) } diff --git a/test/cookie/cookies.js b/test/cookie/cookies.js index 5167f8d64fd..9a389da2ee9 100644 --- a/test/cookie/cookies.js +++ b/test/cookie/cookies.js @@ -449,9 +449,22 @@ test('Set-Cookie parser', () => { name: 'Space', value: 'Cat', secure: true, - httpOnly: true + httpOnly: true, + maxAge: -1 }]) + for (const maxAge of ['-', '--1', '-1a', '+1', '']) { + headers = new Headers({ + 'set-cookie': `Space=Cat; Secure; HttpOnly; Max-Age=${maxAge}` + }) + assert.deepEqual(getSetCookies(headers), [{ + name: 'Space', + value: 'Cat', + secure: true, + httpOnly: true + }]) + } + headers = new Headers({ 'set-cookie': 'Space=Cat; Secure; HttpOnly; Max-Age=2; Domain=deno.land' })