brynary/rack-test — pull request #71 by goosmurf (2013-01-09 06:39:30+00:00)
Title: Prevent truncation of path to empty string when Path attribute is not specified

This is a (hopefully) clearer version of https://github.com/brynary/rack-test/pull/53 which, given your comments, was a little confusing. It is intended to resolve https://github.com/brynary/rack-test/issues/50.

To recap the issue since it's been so long:

In my test I do this:
rack_mock_session.cookie_jar['my_auth_cookie'] = 'blah'

This mimics a user tampering with their cookie - I want to ensure that our system rejects the modified cookie.

Due to the way CookieJar#[]= uses it's merge method to replace the existing cookie, and merge creates new cookies with @default_host, the new cookies are created with an apparent uri-path of '/'.

https://github.com/brynary/rack-test/blob/master/lib/rack/test/cookie_jar.rb#L25 was incorrectly truncating '/' to a final cookie path of '' (empty string).

The intention of that regexp is to implement item 4 of http://tools.ietf.org/html/rfc6265#section-5.1.4.

But it neglects to handle item 2, when the uri-path is '/'. Instead of preserving it as '/' the regexp converts it into '' (empty string).

Since it's quite a subtle bug I decided to re-write that regexp into a few lines of code that almost exactly mirror the structure & wording of the RFC, and I added tests for that specific case.