about summary refs log tree commit homepage
diff options
context:
space:
mode:
authorEric Wong <normalperson@yhbt.net>2010-01-05 17:48:13 -0800
committerEric Wong <normalperson@yhbt.net>2010-01-05 17:48:13 -0800
commitfddbfa6929569685bcb92f54f6938df97bccd575 (patch)
tree7246784f5b5bb620df7d69897ec7627ccb8812e0
parentd541fd3ee9aa4ddbc3b4f8a14bbea43de19a31d9 (diff)
downloadrainbows-fddbfa6929569685bcb92f54f6938df97bccd575.tar.gz
The HeaderHash optimizations in Rack 1.1 interact badly with
Rails 2.3.5 (and possibly other frameworks/apps) which set
multi-value "Set-Cookie" headers without relying on the proper
methods provided by Rack::Utils.

While this is an issue with Rails not using properly, there
may be similar apps that make this mistake and Rack::Lint
does not guard against it.

Rack-ML-Ref: <20100105235845.GB3377@dcvr.yhbt.net>
-rw-r--r--lib/rainbows/http_response.rb3
1 files changed, 2 insertions, 1 deletions
diff --git a/lib/rainbows/http_response.rb b/lib/rainbows/http_response.rb
index 39ebd32..55c2ad2 100644
--- a/lib/rainbows/http_response.rb
+++ b/lib/rainbows/http_response.rb
@@ -16,7 +16,8 @@ module Rainbows
           next if %r{\AX-Rainbows-}i =~ key
           next if SKIP.include?(key.downcase)
           if value =~ /\n/
-            out.concat(value.split(/\n/).map! { |v| "#{key}: #{v}\r\n" })
+            # avoiding blank, key-only cookies with /\n+/
+            out.concat(value.split(/\n+/).map! { |v| "#{key}: #{v}\r\n" })
           else
             out << "#{key}: #{value}\r\n"
           end