Skip to content

Commit 79e1032

Browse files
committed
Use helper function to lookup safe cookie values
This helper function is now used by `set-cookie` and `set-local-storage-item` scriptlets, so changes in the helper function will benefit both scriptlets.
1 parent 3e2171f commit 79e1032

File tree

1 file changed

+31
-25
lines changed

1 file changed

+31
-25
lines changed

assets/resources/scriptlets.js

Lines changed: 31 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -954,6 +954,33 @@ function objectFindOwnerFn(
954954

955955
/******************************************************************************/
956956

957+
builtinScriptlets.push({
958+
name: 'get-safe-cookie-values.fn',
959+
fn: getSafeCookieValuesFn,
960+
});
961+
function getSafeCookieValuesFn() {
962+
return [
963+
'accept', 'reject',
964+
'accepted', 'rejected', 'notaccepted',
965+
'allow', 'disallow', 'deny',
966+
'allowed', 'denied',
967+
'approved', 'disapproved',
968+
'checked', 'unchecked',
969+
'dismiss', 'dismissed',
970+
'enable', 'disable',
971+
'enabled', 'disabled',
972+
'essential', 'nonessential',
973+
'hide', 'hidden',
974+
'necessary', 'required',
975+
'ok',
976+
'on', 'off',
977+
'true', 't', 'false', 'f',
978+
'yes', 'y', 'no', 'n',
979+
];
980+
}
981+
982+
/******************************************************************************/
983+
957984
builtinScriptlets.push({
958985
name: 'get-all-cookies.fn',
959986
fn: getAllCookiesFn,
@@ -1076,6 +1103,7 @@ builtinScriptlets.push({
10761103
name: 'set-local-storage-item.fn',
10771104
fn: setLocalStorageItemFn,
10781105
dependencies: [
1106+
'get-safe-cookie-values.fn',
10791107
'safe-self.fn',
10801108
],
10811109
});
@@ -1097,14 +1125,9 @@ function setLocalStorageItemFn(
10971125
const trustedValues = [
10981126
'',
10991127
'undefined', 'null',
1100-
'false', 'true',
1101-
'on', 'off',
1102-
'yes', 'no',
1103-
'accept', 'reject',
1104-
'accepted', 'rejected',
1105-
'allowed', 'denied',
11061128
'{}', '[]', '""',
11071129
'$remove$',
1130+
...getSafeCookieValuesFn(),
11081131
];
11091132

11101133
if ( trusted ) {
@@ -3819,6 +3842,7 @@ builtinScriptlets.push({
38193842
fn: setCookie,
38203843
world: 'ISOLATED',
38213844
dependencies: [
3845+
'get-safe-cookie-values.fn',
38223846
'safe-self.fn',
38233847
'set-cookie.fn',
38243848
],
@@ -3831,28 +3855,10 @@ function setCookie(
38313855
if ( name === '' ) { return; }
38323856
const safe = safeSelf();
38333857
const logPrefix = safe.makeLogPrefix('set-cookie', name, value, path);
3834-
3835-
const validValues = [
3836-
'accept', 'reject',
3837-
'accepted', 'rejected', 'notaccepted',
3838-
'allow', 'deny',
3839-
'allowed', 'disallow',
3840-
'enable', 'disable',
3841-
'enabled', 'disabled',
3842-
'ok',
3843-
'on', 'off',
3844-
'true', 't', 'false', 'f',
3845-
'yes', 'y', 'no', 'n',
3846-
'necessary', 'required',
3847-
'approved', 'disapproved',
3848-
'hide', 'hidden',
3849-
'essential', 'nonessential',
3850-
'dismiss', 'dismissed',
3851-
'checked', 'unchecked',
3852-
];
38533858
const normalized = value.toLowerCase();
38543859
const match = /^("?)(.+)\1$/.exec(normalized);
38553860
const unquoted = match && match[2] || normalized;
3861+
const validValues = getSafeCookieValuesFn();
38563862
if ( validValues.includes(unquoted) === false ) {
38573863
if ( /^\d+$/.test(unquoted) === false ) { return; }
38583864
const n = parseInt(value, 10);

0 commit comments

Comments
 (0)