Skip to content

Fix a bug where cookies with Max-Age too big are not stored#1094

Merged
rbri merged 1 commit intoHtmlUnit:masterfrom
duonglaiquang:duong_max_age
Mar 12, 2026
Merged

Fix a bug where cookies with Max-Age too big are not stored#1094
rbri merged 1 commit intoHtmlUnit:masterfrom
duonglaiquang:duong_max_age

Conversation

@duonglaiquang
Copy link
Contributor

This PR does the following

Fix HtmlUnitMaxAgeHandler to correctly handle cookies with large, negative, or non-numeric max-age values per RFC 6265.

Problem

When a server sends a cookie with a max-age value that exceeds Integer.MAX_VALUE (e.g max-age=99999999999), Integer.parseInt throws NumberFormatException, which is wrapped into MalformedCookieException, causing the entire cookie to be rejected.

Per RFC 6265, large values should be capped to a limit (400 days) rather than rejected.

Additionally, negative/zero delta-seconds should set expiry to the earliest representable date instead of offsetting current time.

@sonarqubecloud
Copy link

@rbri
Copy link
Member

rbri commented Mar 12, 2026

@duonglaiquang will work on that later today, maybe i can add a unit test.

@duonglaiquang do you need a release for all that? As i'm working towards 5.0, no 4.x releases are planned and the 5.0 might need some more time.

and last - have you seen my email?

@rbri rbri merged commit d15e143 into HtmlUnit:master Mar 12, 2026
8 checks passed
@duonglaiquang
Copy link
Contributor Author

@rbri Thank you very much.
All of these are fixes i have already patched on my end so an immediate release is not needed. I will be looking forward to the next big version 😄

@rbri
Copy link
Member

rbri commented Mar 13, 2026

hope the java17 move is ok for you

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants