1497035 - cookies API allows the creation of cookies with invalid characters in name and value

Status: UNCONFIRMED

(WebExtensions :: General, defect, P3)

Description

[contact]

Attachment: example extension

User Agent: Mozilla/5.0 (X11; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0

Steps to reproduce:

Testet in Firefox 62.0.3 as well as Nightly 64.0a1 (2018-10-06).

Using browser.cookies.set you can create cookies containing characters that are invalid for cookie names and values (e.g. ";").


Actual results:

The cookie is created. This can cause multiple issues:
1) You can create a single cookie that the receiving website interprets as multiple cookies.
2) When you include newline (e.g. \r) in a cookie, there is no cookie header at all being sent to the website it should be sent to.

An example extension is attached.


Expected results:

browser.cookies.set should fail the promise with an error message and not create a cookie.