From 62a08bfa0ae66168cca6aa2e7193944da9bcb9b6 Mon Sep 17 00:00:00 2001 From: Petar Najman Date: Thu, 23 Feb 2023 11:09:37 +0000 Subject: [PATCH] [FIX] web: Quoted cookie values are not handled by cookie_utils.js MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit When we set a cookie value (i.e. 'frontend_lang') on backend which can contain "invalid" character like @ (i.e. Serbian lang code: sr@latin) that cookie value will be double-quoted by werkzeug, so our example cookie will end up like: frontend_lang="sr@latin" instead of what's expected on the front-end: frontend_lang=sr@latin.On the front-end side we need to remove that additional double-quote before returning the actual cookie value. closes odoo/odoo#114565 X-original-commit: 2631c8a39ccb03f5a0f142e479e3264f8885c5d2 Signed-off-by: Géry Debongnie Signed-off-by: Julien Castiaux (juc) --- addons/web/static/src/legacy/js/core/cookie_utils.js | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/addons/web/static/src/legacy/js/core/cookie_utils.js b/addons/web/static/src/legacy/js/core/cookie_utils.js index a8c3a3a8c78..a8049aa3543 100644 --- a/addons/web/static/src/legacy/js/core/cookie_utils.js +++ b/addons/web/static/src/legacy/js/core/cookie_utils.js @@ -16,6 +16,15 @@ const utils = { var cookie = parts.join('='); if (cookieName && cookieName === name) { + if (cookie.startsWith('"')) { + if (cookie.includes('\\')){ + // see werkzeug _cookie_quote + throw new Error( + `Cookie value contains unknown characters ${cookie}` + ) + } + cookie = cookie.slice(1, -1); + } return cookie; } }