File tree Expand file tree Collapse file tree
Expand file tree Collapse file tree Original file line number Diff line number Diff line change @@ -382,20 +382,18 @@ def encryptor_class
382382 require 'uri'
383383
384384 encryptor = Rack ::Session ::Encryptor . new ( @secret , { mode : :v2 } )
385+ encrypted_message = encryptor . encrypt ( { 'foo' => 'bar' } )
385386
386- # Run enough iterations to be statistically certain we exercise values
387- # that would contain '+' under strict Base64 encoding (~90% of payloads).
388- 100 . times do
389- encrypted_message = encryptor . encrypt ( { 'foo' => 'bar' } )
390-
391- # Simulate what Rack::Utils.parse_cookies_header does to cookie values
392- cookie_value_after_rack = URI . decode_www_form_component ( encrypted_message )
387+ # V2 output must only contain URL-safe Base64 characters; '+' and '/'
388+ # are the characters that strict_encode64 produces but urlsafe_encode64
389+ # does not, and which Rack's cookie parser would corrupt.
390+ encrypted_message . must_match ( /\A [A-Za-z0-9\- _=]+\z / )
393391
394- cookie_value_after_rack . must_equal encrypted_message ,
395- 'V2 cookie was corrupted by Rack URI unescaping (+ converted to space)'
392+ # Simulate what Rack::Utils.parse_cookies_header does to cookie values
393+ cookie_value_after_rack = URI . decode_www_form_component ( encrypted_message )
394+ cookie_value_after_rack . must_equal encrypted_message
396395
397- encryptor . decrypt ( cookie_value_after_rack ) . must_equal ( { 'foo' => 'bar' } )
398- end
396+ encryptor . decrypt ( cookie_value_after_rack ) . must_equal ( { 'foo' => 'bar' } )
399397 end
400398 end
401399end
You can’t perform that action at this time.
0 commit comments