fix: accept a negative Set-Cookie Max-Age attribute (#5571)

* fix: accept a negative Set-Cookie Max-Age attribute

Signed-off-by: arshiya tabasum <arshi@bugqore.com>

* fix: check only the Max-Age remainder for non-DIGIT characters

Signed-off-by: arshiya tabasum <arshi@bugqore.com>

* revert Max-Age step 1 comment to the pinned spec wording

Signed-off-by: arshiya tabasum <arshi@bugqore.com>

---------

Signed-off-by: arshiya tabasum <arshi@bugqore.com>

Author: arshsmith1

lib/web/cookies/parse.js

@@ -189,14 +189,16 @@ function parseUnparsedAttributes (unparsedAttributes, cookieAttributeList = {})
     // 1. If the first character of the attribute-value is not a DIGIT or a
     //    "-" character, ignore the cookie-av.
     const charCode = attributeValue.charCodeAt(0)
+    const startsWithDigit = charCode >= 48 && charCode <= 57
+    const startsWithSignedDigit = attributeValue[0] === '-' && attributeValue.length > 1
 
-    if ((charCode < 48 || charCode > 57) && attributeValue[0] !== '-') {
+    if (!startsWithDigit && !startsWithSignedDigit) {
       return parseUnparsedAttributes(unparsedAttributes, cookieAttributeList)
     }
 
     // 2. If the remainder of attribute-value contains a non-DIGIT
     //    character, ignore the cookie-av.
-    if (!/^\d+$/.test(attributeValue)) {
+    if (/[^\d]/.test(attributeValue.slice(1))) {
       return parseUnparsedAttributes(unparsedAttributes, cookieAttributeList)
     }
 

test/cookie/cookies.js

@@ -465,9 +465,22 @@ test('Set-Cookie parser', () => {
     name: 'Space',
     value: 'Cat',
     secure: true,
-    httpOnly: true
+    httpOnly: true,
+    maxAge: -1
   }])
 
+  for (const maxAge of ['-', '--1', '-1a', '+1', '']) {
+    headers = new Headers({
+      'set-cookie': `Space=Cat; Secure; HttpOnly; Max-Age=${maxAge}`
+    })
+    assert.deepEqual(getSetCookies(headers), [{
+      name: 'Space',
+      value: 'Cat',
+      secure: true,
+      httpOnly: true
+    }])
+  }
+
   headers = new Headers({
     'set-cookie': 'Space=Cat; Secure; HttpOnly; Max-Age=2; Domain=deno.land'
   })