Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Don't check cookie value if cookie was deleted #17830

Merged
merged 2 commits into from Jul 29, 2021
Merged

Conversation

sgiehl
Copy link
Member

@sgiehl sgiehl commented Jul 28, 2021

Description:

The issue is reproducible calling _paq.push(['setCookieDomain', 'custom.matomo.dev']);, which tries to set and remove a cookie on the given domain.

fixes #17829

Review

  • Functional review done
  • Potential edge cases thought about (behavior of the code with strange input, with strange internal state or possible interactions with other Matomo subsystems)
  • Usability review done (is anything maybe unclear or think about anything that would cause people to reach out to support)
  • Security review done see checklist
  • Code review done
  • Tests were added if useful/possible
  • Reviewed for breaking changes
  • Developer changelog updated if needed
  • Documentation added if needed
  • Existing documentation updated if needed

@sgiehl sgiehl added not-in-changelog For issues or pull requests that should not be included in our release changelog on matomo.org. Needs Review PRs that need a code review labels Jul 28, 2021
@sgiehl sgiehl added this to the 4.5.0 milestone Jul 28, 2021
@diosmosis
Copy link
Member

is it possible to test this?

@Findus23
Copy link
Member

Does the test fail if any errors are logged during the execution?

@diosmosis
Copy link
Member

@Findus23 I'm not sure, but unless an exception is thrown, I doubt it.

@@ -2449,7 +2449,7 @@ if (typeof window.Matomo !== 'object') {
';SameSite=' + sameSite;

// check the cookie was actually set
if (getCookie(cookieName) !== value) {
if ((!msToExpire || msToExpire >= 0) && getCookie(cookieName) !== value) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

should it be msToExpire >= 1 or >= 5 maybe as the value might be expired by the time it's set and read? I suppose we don't set such values so it doesn't really matter.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Guess no one should use such low values for expire time. If someone does nevertheless, might be good to have a warning, as it simply might not make any sense to set a cookie that expires before it can be used 🙈

@sgiehl
Copy link
Member Author

sgiehl commented Jul 29, 2021

@diosmosis @Findus23 Within the javascript tests setCookieDomain is used, and it actually throws that error on console multiple times. But those errors are ignored and might be hard to test. Guess we would need to overwrite console.error and console.log in order to be able to get and compare the log message. Will check if that's fast to implement...

@sgiehl
Copy link
Member Author

sgiehl commented Jul 29, 2021

Tried writing some tests for a while now, but for some reason the error message is not triggered when I would expect it (like setting an invalid cookie domain). It's only triggered when a cookie is deleted, which should be fixed with the changes here...

@diosmosis
Copy link
Member

@sgiehl if the test fails in 4.x-dev then it's still useful, right? If it's not possible though then I guess it's not vital.

@sgiehl
Copy link
Member Author

sgiehl commented Jul 29, 2021 via email

@diosmosis diosmosis modified the milestones: 4.5.0, 4.4.1 Jul 29, 2021
@diosmosis
Copy link
Member

Added a test that fails on 4.x-dev but passes on this branch. Will merge now.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Needs Review PRs that need a code review not-in-changelog For issues or pull requests that should not be included in our release changelog on matomo.org.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Testcookie causes warning in browser console
4 participants