Coraza mis-split cookies with control bytes; a Claude-co-authored 3.8.0 fix trimmed them but dropped cookies whose name was only control bytes, letting a client hide a cookie value from rules.

@@ -4,7 +4,6 @@ package cookies  import (

-	"net/textproto" 	"strings"

 ) @@ -14,7 +13,7 @@ import ( func ParseCookies(rawCookies string) map[string][]string { 	cookies := make(map[string][]string) -	rawCookies = textproto.TrimString(rawCookies)+	rawCookies = trimCTLAndSpace(rawCookies)  	if rawCookies == "" { 		return cookies@@ -23,12 +22,13 @@ func ParseCookies(rawCookies string) map[string][]string { 	var part string 	for len(rawCookies) > 0 { // continue since we have rest 		part, rawCookies, _ = strings.Cut(rawCookies, ";")-		part = textproto.TrimString(part)+		part = trimCTLAndSpace(part) 		if part == "" { 			continue 		} 		name, val, _ := strings.Cut(part, "=")-		name = textproto.TrimString(name)+		name = trimCTLAndSpace(name)+		val = trimCTLAndSpace(val) 		// if name is empty (eg: "Cookie:   =foo;") skip it 		if name == "" { 			continue@@ -37,3 +37,41 @@ func ParseCookies(rawCookies string) map[string][]string { 	} 	return cookies }++// trimCTLAndSpace trims leading/trailing ASCII control characters (RFC 2616+// CTL: octets 0x00-0x1F and 0x7F) and spaces -- a superset of+// net/textproto.TrimString's space/tab-only trim. Per RFC 6265, neither a+// cookie-name (token) nor a cookie-value (cookie-octet) may contain CTLs.

+// The `<= 0x20` comparison covers octets 0x00-0x20, i.e. every CTL plus+// space (0x20); 0x7F is the one CTL above that range.+//+// A stray CTL character (e.g. a vertical tab) directly adjacent to '='+// used to be kept as part of the cookie name instead of being treated as a+// boundary, letting the name/value split land somewhere a real consumer+// wouldn't put it -- see GHSA-g4qm-m288-5cp9. Every cookie-value/name+// grammar we checked (RFC 6265's own token/cookie-octet definitions,+// Python's http.cookies/Werkzeug, Node's cookie package) treats CTLs as+// invalid at the token boundary; only where a CTL lands is disputed across+// implementations once it's in the interior of an otherwise-plausible name,+// which this fix does not attempt to resolve.+//+// Deliberately hand-rolled rather than strings.TrimFunc: TrimFunc invokes+// its predicate through a func value once per byte scanned, which measured

+// ~5x slower on a CTL-saturated header. Cookie headers are attacker+// controlled and parsed on every request, so that constant factor is a+// CPU-amplification primitive, not just a micro-optimization. See+// BenchmarkParseCookies/CTLFlood. strings.TrimSpace is not a substitute+// either: it misses most CTLs and additionally trims U+0085/U+00A0, whose+// multi-byte encodings a backend would not strip -- reintroducing the very+// parser-disagreement class this fix closes.+func trimCTLAndSpace(s string) string {+	start := 0+	for start < len(s) && (s[start] <= 0x20 || s[start] == 0x7f) {+		start++

+	}+	end := len(s)+	for end > start && (s[end-1] <= 0x20 || s[end-1] == 0x7f) {+		end--+	}+	return s[start:end]+}

@@ -29,8 +29,13 @@ func ParseCookies(rawCookies string) map[string][]string { 		name, val, _ := strings.Cut(part, "=") 		name = trimCTLAndSpace(name) 		val = trimCTLAndSpace(val)

-		// if name is empty (eg: "Cookie:   =foo;") skip it-		if name == "" {

+		// A name that is empty, or only CTLs and spaces, is kept under ""+		// rather than skipped: Node's cookie package still hands+		// "=payload" and "\x01=payload" to the application, so dropping+		// the pair would hide its value from REQUEST_COOKIES. Only a+		// pair with nothing left to inspect ("=") is skipped.+		// See GHSA-g4qm-m288-5cp9.+		if name == "" && val == "" {

 			continue 		} 		cookies[name] = append(cookies[name], val)@@ -48,12 +53,12 @@ func ParseCookies(rawCookies string) map[string][]string { // A stray CTL character (e.g. a vertical tab) directly adjacent to '=' // used to be kept as part of the cookie name instead of being treated as a // boundary, letting the name/value split land somewhere a real consumer-// wouldn't put it -- see GHSA-g4qm-m288-5cp9. Every cookie-value/name-// grammar we checked (RFC 6265's own token/cookie-octet definitions,-// Python's http.cookies/Werkzeug, Node's cookie package) treats CTLs as-// invalid at the token boundary; only where a CTL lands is disputed across-// implementations once it's in the interior of an otherwise-plausible name,-// which this fix does not attempt to resolve.+// wouldn't put it -- see GHSA-g4qm-m288-5cp9. RFC 6265's token and+// cookie-octet grammar excludes CTLs, and Python's http.cookies splits+// "a\v=x" as name "a". Backends disagree, though: Node's cookie package+// and Werkzeug keep "a\v" as the name. The trim follows the RFC; where a+// CTL lands in the interior of an otherwise-plausible name is left+// unresolved. // // Deliberately hand-rolled rather than strings.TrimFunc: TrimFunc invokes // its predicate through a func value once per byte scanned, which measured

@@ -685,7 +685,9 @@ func (tx *Transaction) GetField(rv ruleVariableParams) []types.MatchData { 		isException := false 		lkey := strings.ToLower(c.Key()) 		for _, ex := range rv.Exceptions {-			if (ex.KeyRx != nil && ex.KeyRx.MatchString(lkey)) || strings.ToLower(ex.KeyStr) == lkey || (ex.KeyStr == "" && ex.KeyRx == nil) {+			// KeyStr is only meaningful without KeyRx: a regex exception from ctl+			// carries an empty KeyStr, which would otherwise match a key named "".+			if (ex.KeyRx != nil && ex.KeyRx.MatchString(lkey)) || (ex.KeyRx == nil && (ex.KeyStr == "" || strings.ToLower(ex.KeyStr) == lkey)) { 				isException = true 				break 			}