The npm package cookie, a utility for parsing and serializing HTTP cookies, saw a minor version bump from 0.1.1 to 0.1.2 in April 2014, building upon its foundation of simple cookie handling. Both versions offer the core functionality of encoding and decoding cookies, crucial for managing user sessions and preferences in web applications. A key aspect is their lack of external dependencies, making them lightweight and easy to integrate without adding bloat to your project. Both versions are primarily intended to parse and serialize cookies. Notably, both versions share the same development dependencies (mocha for testing) and identical author and repository information, suggesting a maintenance release.
The difference between the two is marked by their release dates, they were released within a span of roughly 2 months. This implies the newer version probably involved bug fixes, minor improvements, or security patches. For developers choosing between these versions, opting for 0.1.2 is generally recommended, assuming the change introduces subtle bug fixes or security improvements. It retains the simplicity and dependency-free nature of 0.1.1 while likely offering a more polished experience. In essence, both versions provide a reliable way to manage cookies, but version 0.1.2 is likely better tested and more secure.
All the vulnerabilities related to the version 0.1.2 of the package
cookie accepts cookie name, path, and domain with out of bounds characters
The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. For example, serialize("userName=<script>alert('XSS3')</script>; Max-Age=2592000; a", value) would result in "userName=<script>alert('XSS3')</script>; Max-Age=2592000; a=test", setting userName cookie to <script> and ignoring value.
A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie.
Upgrade to 0.7.0, which updates the validation for name, path, and domain.
Avoid passing untrusted or arbitrary values for these fields, ensure they are set by the application instead of user input.
