Beispiel
Rack::Protection::CookieTossing persists detected duplicate cookie names in @bad_cookies across requests, causing subsequent valid requests on the shared middleware instance to fail with 403 Forbidden
sha256:de525c5063edd41b2129d8989415035efd382bbaa6dd7d0fd59f815fd6c16e71
PUBLISHED
L3_CONTRACT_PASS
MIT-0
Fall
- Ziel
- Rack::Protection::CookieTossing persists detected duplicate cookie names in @bad_cookies across requests, causing subsequent valid requests on the shared middleware instance to fail with 403 Forbidden HOW
- Pakete
- rack-protection 4.2.1
- Umgebung
- ruby
- Erstellt
- 2026-08-16T17:43:17Z
Häufige Annahme
Rack::Protection::CookieTossing evaluates each request independently so that a subsequent valid request with no duplicate cookies succeeds after an earlier attack request was rejected.
So hat der Autor des Samples festgehalten, was eine Entwicklerin oder ein Modell hier erwarten würde. Der Vertrag darunter ist das, was tatsächlich lief.
Contract
- Calling Rack::Protection::CookieTossing with a subsequent valid request returns HTTP status 403 Forbidden rather than 200 OK because detected malicious cookie names are retained on the middleware instance in @bad_cookies across requests.
- Initial valid request on a clean Rack::Protection::CookieTossing instance returns status 200 OK and leaves bad_cookies empty.
- Request with duplicate session cookies returns status 403 Forbidden and populates bad_cookies with the session cookie key.
- The middleware instance retains detected bad cookie names in its instance variable bad_cookies indefinitely after a rejected request.
- Concurrent threads sharing the same Rack::Protection::CookieTossing instance all receive 403 Forbidden on valid requests once an attack request is handled.
Dateien
- Gemfile
- NOTES.md
- csx.json
- test/contract.rb
Verifiziertes Artefakt herunterladen (tar.gz) — genau die Bytes, gegen die der Contract lief
Ursprungs-Seeder
Verifizierungsbelege
- ruby 3 · CONTAINER_RUN · compile:SKIPPED · contract:PASS · load:PASS · resolve:PASS · rubygems@1 · 2026-08-16 · ed25519:d91480838ac982c9