search

ScottHamper / Cookies

JavaScript Client-Side Cookie Manipulation Library
The Unlicense
1.77k stars 169 forks source link

Can't read document.cookie that contains the value % #67

Closed guymoy closed 7 years ago

guymoy commented 7 years ago

Application breaks when trying to read the cookies. If one of the cookies contains a value with % the application stops!

I think maybe need to wrap the decodeURIComponenet with try and catch

Thanks for this component this is very helpful.

error code: Uncaught URIError: URI malformed at decodeURIComponent () at Function.n._getKeyValuePairFromCookieString (app.js:40) at Function.n._getCacheFromString (app.js:40) at Function.n._renewCache (app.js:40) at Function.n.get (app.js:40) at Function.n._areEnabled (app.js:40) at i (app.js:40) at app.js:40 at Object. (app.js:40) at Object.r.105._process (app.js:40)

ScottHamper commented 7 years ago

Hey @guymoy,

The issue is that the cookie value is not properly URI encoded. Cookies.js expects all keys/values to be URI encoded (percent encoded), but in your specific use case, it sounds like the percent sign in the cookie value is intended to be a literal percent sign character, and not the start of an escape sequence. What follows after the percent sign is not a valid escape sequence, and so Cookies.js throws the URI malformed error.

For cookie keys that are malformed like this, Cookies.js does use a try/catch block so that one bad cookie key does not prevent the library from parsing other keys that are not malformed (Cookies.js has to iterate through and decode all the keys until it finds the cookie you're looking for). However, with cookie values, the only one that will attempt to be decoded is the one you're looking for, and there is no way for Cookies.js to retrieve a value that is malformed (other than to avoid doing any URI encoding/decoding, which is not a feature I'm looking to implement at this time). In this situation, Cookies.js should be loud about the error and not silently fail.

So at the moment, this behavior is working as intended. In the future, there may be a possibility of allowing for alternate encodings of cookie keys/values, but for now, everything must be properly URI encoded. This requirement is highlighted in the readme under the section A Note About Encoding.

See #22 and #47 for additional background.