From 368572c4c10d8ace67b952ad281c056f447d4a97 Mon Sep 17 00:00:00 2001 From: Yarchik Date: Thu, 2 Jul 2026 11:06:32 +0100 Subject: [PATCH] fix: ignore an unparseable Set-Cookie Expires attribute parseSetCookie assigned an Invalid Date to cookieAttributeList.expires when the Expires attribute failed to parse, instead of ignoring the attribute. RFC 6265bis 5.4.1 step 2 says to ignore the cookie-av when the date does not parse, which the adjacent code comment already stated. Only set expires when the parsed date is valid. --- lib/web/cookies/parse.js | 5 +++-- test/cookie/cookies.js | 8 ++++++++ 2 files changed, 11 insertions(+), 2 deletions(-) diff --git a/lib/web/cookies/parse.js b/lib/web/cookies/parse.js index 0e524908077..51854822a8b 100644 --- a/lib/web/cookies/parse.js +++ b/lib/web/cookies/parse.js @@ -178,8 +178,9 @@ function parseUnparsedAttributes (unparsedAttributes, cookieAttributeList = {}) // 2. If the attribute-value failed to parse as a cookie date, ignore // the cookie-av. - - cookieAttributeList.expires = expiryTime + if (!Number.isNaN(expiryTime.getTime())) { + cookieAttributeList.expires = expiryTime + } } else if (attributeNameLowercase === 'max-age') { // https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis#section-5.4.2 // If the attribute-name case-insensitively matches the string "Max- diff --git a/test/cookie/cookies.js b/test/cookie/cookies.js index 27f3708e5cc..5167f8d64fd 100644 --- a/test/cookie/cookies.js +++ b/test/cookie/cookies.js @@ -745,3 +745,11 @@ test('Cookie getCookie does not throw if headers is an instance of the global He const headers = new globalThis.Headers() deleteCookie(headers, 'deno') }) + +test('Set-Cookie parser ignores an unparseable Expires', () => { + const headers = new Headers({ 'set-cookie': 'id=a3fWa; Expires=not-a-date' }) + assert.deepEqual(getSetCookies(headers), [{ + name: 'id', + value: 'a3fWa' + }]) +})