@@ -954,6 +954,33 @@ function objectFindOwnerFn(
954
954
955
955
/******************************************************************************/
956
956
957
+ builtinScriptlets . push ( {
958
+ name : 'get-safe-cookie-values.fn' ,
959
+ fn : getSafeCookieValuesFn ,
960
+ } ) ;
961
+ function getSafeCookieValuesFn ( ) {
962
+ return [
963
+ 'accept' , 'reject' ,
964
+ 'accepted' , 'rejected' , 'notaccepted' ,
965
+ 'allow' , 'disallow' , 'deny' ,
966
+ 'allowed' , 'denied' ,
967
+ 'approved' , 'disapproved' ,
968
+ 'checked' , 'unchecked' ,
969
+ 'dismiss' , 'dismissed' ,
970
+ 'enable' , 'disable' ,
971
+ 'enabled' , 'disabled' ,
972
+ 'essential' , 'nonessential' ,
973
+ 'hide' , 'hidden' ,
974
+ 'necessary' , 'required' ,
975
+ 'ok' ,
976
+ 'on' , 'off' ,
977
+ 'true' , 't' , 'false' , 'f' ,
978
+ 'yes' , 'y' , 'no' , 'n' ,
979
+ ] ;
980
+ }
981
+
982
+ /******************************************************************************/
983
+
957
984
builtinScriptlets . push ( {
958
985
name : 'get-all-cookies.fn' ,
959
986
fn : getAllCookiesFn ,
@@ -1076,6 +1103,7 @@ builtinScriptlets.push({
1076
1103
name : 'set-local-storage-item.fn' ,
1077
1104
fn : setLocalStorageItemFn ,
1078
1105
dependencies : [
1106
+ 'get-safe-cookie-values.fn' ,
1079
1107
'safe-self.fn' ,
1080
1108
] ,
1081
1109
} ) ;
@@ -1097,14 +1125,9 @@ function setLocalStorageItemFn(
1097
1125
const trustedValues = [
1098
1126
'' ,
1099
1127
'undefined' , 'null' ,
1100
- 'false' , 'true' ,
1101
- 'on' , 'off' ,
1102
- 'yes' , 'no' ,
1103
- 'accept' , 'reject' ,
1104
- 'accepted' , 'rejected' ,
1105
- 'allowed' , 'denied' ,
1106
1128
'{}' , '[]' , '""' ,
1107
1129
'$remove$' ,
1130
+ ...getSafeCookieValuesFn ( ) ,
1108
1131
] ;
1109
1132
1110
1133
if ( trusted ) {
@@ -3819,6 +3842,7 @@ builtinScriptlets.push({
3819
3842
fn : setCookie ,
3820
3843
world : 'ISOLATED' ,
3821
3844
dependencies : [
3845
+ 'get-safe-cookie-values.fn' ,
3822
3846
'safe-self.fn' ,
3823
3847
'set-cookie.fn' ,
3824
3848
] ,
@@ -3831,28 +3855,10 @@ function setCookie(
3831
3855
if ( name === '' ) { return ; }
3832
3856
const safe = safeSelf ( ) ;
3833
3857
const logPrefix = safe . makeLogPrefix ( 'set-cookie' , name , value , path ) ;
3834
-
3835
- const validValues = [
3836
- 'accept' , 'reject' ,
3837
- 'accepted' , 'rejected' , 'notaccepted' ,
3838
- 'allow' , 'deny' ,
3839
- 'allowed' , 'disallow' ,
3840
- 'enable' , 'disable' ,
3841
- 'enabled' , 'disabled' ,
3842
- 'ok' ,
3843
- 'on' , 'off' ,
3844
- 'true' , 't' , 'false' , 'f' ,
3845
- 'yes' , 'y' , 'no' , 'n' ,
3846
- 'necessary' , 'required' ,
3847
- 'approved' , 'disapproved' ,
3848
- 'hide' , 'hidden' ,
3849
- 'essential' , 'nonessential' ,
3850
- 'dismiss' , 'dismissed' ,
3851
- 'checked' , 'unchecked' ,
3852
- ] ;
3853
3858
const normalized = value . toLowerCase ( ) ;
3854
3859
const match = / ^ ( " ? ) ( .+ ) \1$ / . exec ( normalized ) ;
3855
3860
const unquoted = match && match [ 2 ] || normalized ;
3861
+ const validValues = getSafeCookieValuesFn ( ) ;
3856
3862
if ( validValues . includes ( unquoted ) === false ) {
3857
3863
if ( / ^ \d + $ / . test ( unquoted ) === false ) { return ; }
3858
3864
const n = parseInt ( value , 10 ) ;
0 commit comments