[fit] validate cookie before adding to collection

Author: Mai-icy

framework/fit/java/fit-builtin/services/fit-http-classic/definition/src/main/java/modelengine/fit/http/support/DefaultCookieCollection.java

@@ -88,6 +88,9 @@ public void add(Cookie cookie) {
         if (cookie == null || StringUtils.isBlank(cookie.name())) {
             return;
         }
+        if (!HttpUtils.isValidCookiePair(cookie.name(), cookie.value())) {
+            throw new IllegalArgumentException("Invalid cookie: name or value is not allowed");
+        }
         store.computeIfAbsent(cookie.name(), k -> new ArrayList<>());
         List<Cookie> list = store.get(cookie.name());
         list.removeIf(c ->

framework/fit/java/fit-builtin/services/fit-http-classic/definition/src/test/java/modelengine/fit/http/header/ConfigurableCookieCollectionTest.java

@@ -54,6 +54,32 @@ void shouldReturnAllCookie() {
         assertThat(cookies).hasSize(1);
     }
 
+    @Test
+    @DisplayName("添加非法 Cookie 应抛异常")
+    void shouldThrowExceptionForInvalidCookie() {
+        ConfigurableCookieCollection collection = ConfigurableCookieCollection.create();
+
+        Cookie invalidNameCookie = Cookie.builder().name("inva;lid").value("123").build();
+        assertThatThrownBy(() -> collection.add(invalidNameCookie)).isInstanceOf(IllegalArgumentException.class);
+
+        Cookie invalidValueCookie = Cookie.builder().name("validName").value("v@lue;").build();
+        assertThatThrownBy(() -> collection.add(invalidValueCookie)).isInstanceOf(IllegalArgumentException.class);
+
+        Cookie nullValueCookie = Cookie.builder().name("someName").value(null).build();
+        assertThatThrownBy(() -> collection.add(nullValueCookie)).isInstanceOf(IllegalArgumentException.class);
+    }
+
+    @Test
+    @DisplayName("允许空字符串 value")
+    void shouldHandleEmptyAndNullValue() {
+        ConfigurableCookieCollection collection = ConfigurableCookieCollection.create();
+
+        // 空字符串 value 是允许的
+        Cookie emptyValueCookie = Cookie.builder().name("token").value("").build();
+        collection.add(emptyValueCookie);
+        assertThat(collection.get("token")).isPresent().get().extracting(Cookie::value).isEqualTo("");
+    }
+
     @Test
     @DisplayName("同名 Cookie 不同路径可共存")
     void shouldAllowMultipleCookiesWithDifferentPath() {