Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: Use default cookie decoder instead of bare native #13037

Merged
merged 6 commits into from
Nov 21, 2024
Merged

fix: Use default cookie decoder instead of bare native #13037

merged 6 commits into from
Nov 21, 2024

Commits on Nov 21, 2024

  1. fix: Use default cookie decoder instead of bare native 

    SvelteKit currently depends on cookie@0.6.0 which has known
security vulnerability. User can create an override if they do
not need to keep the backward compatibility.

cookie@0.6.0 wraps the passed decoder in try..catch but the new
version does not. When overriding, the `cookies.get` will throw
if passed in cookie contains malformed content.

In both cases the default `decode` of `cookie` library also
has small performance optimization so removing the passing of
decodeURIComponent should be win already.
    @kkarikos
    kkarikos committed Nov 21, 2024
    Configuration menu
    Copy the full SHA
    87955d8 View commit details
    Browse the repository at this point in the history

  2. add changeset

    @kkarikos
    kkarikos committed Nov 21, 2024
    Configuration menu
    Copy the full SHA
    b3e2ace View commit details
    Browse the repository at this point in the history

  3. Update .changeset/plenty-oranges-count.md 

    Co-authored-by: Simon H <5968653+dummdidumm@users.noreply.github.com>
    @kkarikos @dummdidumm
    kkarikos and dummdidumm authored Nov 21, 2024
    Configuration menu
    Copy the full SHA
    c88916b View commit details
    Browse the repository at this point in the history

  4. Update packages/kit/src/runtime/server/cookie.js

    @benmccann
    benmccann authored Nov 21, 2024
    Configuration menu
    Copy the full SHA
    3c83ff7 View commit details
    Browse the repository at this point in the history

  5. Update packages/kit/src/runtime/server/cookie.js

    @benmccann
    benmccann authored Nov 21, 2024
    Configuration menu
    Copy the full SHA
    6fc4a6e View commit details
    Browse the repository at this point in the history

  6. Update .changeset/plenty-oranges-count.md

    @benmccann
    benmccann authored Nov 21, 2024
    Configuration menu
    Copy the full SHA
    9403593 View commit details
    Browse the repository at this point in the history