Repository navigation
cgi 0.34 or higher does not allow .example.com as domain #35
Description
Rails CI using Ruby 3.2.0-dev fails https://buildkite.com/rails/rails/builds/91200#0184aae9-a971-4423-8bb6-60e7a14ec3fb/1048-1057
Investigated this failure and it is likely due to cgi behavior change between 0.3.3 and 0.3.4 because cgi default gem version has bumped to 0.3.5 recently https://www.ruby-lang.org/en/news/2022/11/22/http-response-splitting-in-cgi-cve-2021-33621/
Steps to reproduce
require 'cgi'
CGI::Cookie.new('domain'=>'.example.com', 'name'=>'name1')Expected behavior
It returns []
% gem install cgi -v 0.3.3
Fetching cgi-0.3.3.gem
Building native extensions. This could take a while...
Successfully installed cgi-0.3.3
Parsing documentation for cgi-0.3.3
Installing ri documentation for cgi-0.3.3
Done installing documentation for cgi after 0 seconds
1 gem installed
% irb
irb(main):001:0> require 'cgi'
irb(main):002:0> CGI::Cookie.new('domain'=>'.example.com', 'name'=>'name1')
=> []
irb(main):003:0>
Actual behavior
It raises ArgumentError
% gem install cgi -v 0.3.4
Fetching cgi-0.3.4.gem
Building native extensions. This could take a while...
Successfully installed cgi-0.3.4
Parsing documentation for cgi-0.3.4
Installing ri documentation for cgi-0.3.4
Done installing documentation for cgi after 0 seconds
1 gem installed
% irb
irb(main):001:0> require 'cgi'
irb(main):002:0> CGI::Cookie.new('domain'=>'.example.com', 'name'=>'name1')
/Users/yahonda/.rbenv/versions/3.1.2/lib/ruby/gems/3.1.0/gems/cgi-0.3.4/lib/cgi/cookie.rb:128:in `domain=': invalid domain: ".example.com" (ArgumentError)
from /Users/yahonda/.rbenv/versions/3.1.2/lib/ruby/gems/3.1.0/gems/cgi-0.3.4/lib/cgi/cookie.rb:95:in `initialize'
from (irb):2:in `new'
from (irb):2:in `<main>'
from /Users/yahonda/.rbenv/versions/3.1.2/lib/ruby/gems/3.1.0/gems/irb-1.4.2/exe/irb:11:in `<top (required)>'
from /Users/yahonda/.rbenv/versions/3.1.2/bin/irb:25:in `load'
from /Users/yahonda/.rbenv/versions/3.1.2/bin/irb:25:in `<main>'
irb(main):003:0>
Activity
yahonda commentedon Nov 25, 2022
It also reproduces with cgi 0.3.5. I intentionally uses ruby 3.1.2 to compare the result using older versions of CGI.
hsbt commentedon Nov 25, 2022
It's duplicate of #29
yahonda commentedon Nov 25, 2022
Thanks for the info. I have overlooked #29 . Let me close this issue and will see how #29 goes.