blackteay/gin
3
0
Fork 0
mirror of https://github.com/gin-gonic/gin.git synced 2025-04-06 03:57:46 +08:00
Code Issues Projects Releases Wiki Activity

Do not QueryEscape cookies (#1717)

Browse Source 
Cookies values are already sanitized by the Go http library, so there is
no need to invoke QueryEscape() on them.
Furthermore, QueryEscape() has the undesirable effect of replacing
spaces wiith "+" characters.
This commit is contained in:
Ludovico Cavedon 2023-08-02 00:13:28 +02:00
parent d4a64265f2
commit 929794596f
2 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
context.go
View File

@ -890,7 +890,7 @@ func (c *Context) SetCookie(name, value string, maxAge int, path, domain string,
}
http.SetCookie(c.Writer, &http.Cookie{
Name: name,
Value: url.QueryEscape(value),
Value: value,
MaxAge: maxAge,
Path: path,
Domain: domain,

7
context_test.go
View File

@ -627,6 +627,13 @@ func TestContextSetCookiePathEmpty(t *testing.T) {
assert.Equal(t, "user=gin; Path=/; Domain=localhost; Max-Age=1; HttpOnly; Secure; SameSite=Lax", c.Writer.Header().Get("Set-Cookie"))
}
func TestContextSetCookieWithSpace(t *testing.T) {
c, _ := CreateTestContext(httptest.NewRecorder())
c.SetSameSite(http.SameSiteLaxMode)
c.SetCookie("user", "gin test", 1, "/", "localhost", true, true)
assert.Equal(t, "user=\"gin test\"; Path=/; Domain=localhost; Max-Age=1; HttpOnly; Secure; SameSite=Lax", c.Writer.Header().Get("Set-Cookie"))
}
func TestContextGetCookie(t *testing.T) {
c, _ := CreateTestContext(httptest.NewRecorder())
c.Request, _ = http.NewRequest("GET", "/get", nil)