@@ -954,6 +954,33 @@ function objectFindOwnerFn(
954954
955955/******************************************************************************/
956956
957+ builtinScriptlets . push ( {
958+ name : 'get-safe-cookie-values.fn' ,
959+ fn : getSafeCookieValuesFn ,
960+ } ) ;
961+ function getSafeCookieValuesFn ( ) {
962+ return [
963+ 'accept' , 'reject' ,
964+ 'accepted' , 'rejected' , 'notaccepted' ,
965+ 'allow' , 'disallow' , 'deny' ,
966+ 'allowed' , 'denied' ,
967+ 'approved' , 'disapproved' ,
968+ 'checked' , 'unchecked' ,
969+ 'dismiss' , 'dismissed' ,
970+ 'enable' , 'disable' ,
971+ 'enabled' , 'disabled' ,
972+ 'essential' , 'nonessential' ,
973+ 'hide' , 'hidden' ,
974+ 'necessary' , 'required' ,
975+ 'ok' ,
976+ 'on' , 'off' ,
977+ 'true' , 't' , 'false' , 'f' ,
978+ 'yes' , 'y' , 'no' , 'n' ,
979+ ] ;
980+ }
981+
982+ /******************************************************************************/
983+
957984builtinScriptlets . push ( {
958985 name : 'get-all-cookies.fn' ,
959986 fn : getAllCookiesFn ,
@@ -1076,6 +1103,7 @@ builtinScriptlets.push({
10761103 name : 'set-local-storage-item.fn' ,
10771104 fn : setLocalStorageItemFn ,
10781105 dependencies : [
1106+ 'get-safe-cookie-values.fn' ,
10791107 'safe-self.fn' ,
10801108 ] ,
10811109} ) ;
@@ -1097,14 +1125,9 @@ function setLocalStorageItemFn(
10971125 const trustedValues = [
10981126 '' ,
10991127 'undefined' , 'null' ,
1100- 'false' , 'true' ,
1101- 'on' , 'off' ,
1102- 'yes' , 'no' ,
1103- 'accept' , 'reject' ,
1104- 'accepted' , 'rejected' ,
1105- 'allowed' , 'denied' ,
11061128 '{}' , '[]' , '""' ,
11071129 '$remove$' ,
1130+ ...getSafeCookieValuesFn ( ) ,
11081131 ] ;
11091132
11101133 if ( trusted ) {
@@ -3819,6 +3842,7 @@ builtinScriptlets.push({
38193842 fn : setCookie ,
38203843 world : 'ISOLATED' ,
38213844 dependencies : [
3845+ 'get-safe-cookie-values.fn' ,
38223846 'safe-self.fn' ,
38233847 'set-cookie.fn' ,
38243848 ] ,
@@ -3831,28 +3855,10 @@ function setCookie(
38313855 if ( name === '' ) { return ; }
38323856 const safe = safeSelf ( ) ;
38333857 const logPrefix = safe . makeLogPrefix ( 'set-cookie' , name , value , path ) ;
3834-
3835- const validValues = [
3836- 'accept' , 'reject' ,
3837- 'accepted' , 'rejected' , 'notaccepted' ,
3838- 'allow' , 'deny' ,
3839- 'allowed' , 'disallow' ,
3840- 'enable' , 'disable' ,
3841- 'enabled' , 'disabled' ,
3842- 'ok' ,
3843- 'on' , 'off' ,
3844- 'true' , 't' , 'false' , 'f' ,
3845- 'yes' , 'y' , 'no' , 'n' ,
3846- 'necessary' , 'required' ,
3847- 'approved' , 'disapproved' ,
3848- 'hide' , 'hidden' ,
3849- 'essential' , 'nonessential' ,
3850- 'dismiss' , 'dismissed' ,
3851- 'checked' , 'unchecked' ,
3852- ] ;
38533858 const normalized = value . toLowerCase ( ) ;
38543859 const match = / ^ ( " ? ) ( .+ ) \1$ / . exec ( normalized ) ;
38553860 const unquoted = match && match [ 2 ] || normalized ;
3861+ const validValues = getSafeCookieValuesFn ( ) ;
38563862 if ( validValues . includes ( unquoted ) === false ) {
38573863 if ( / ^ \d + $ / . test ( unquoted ) === false ) { return ; }
38583864 const n = parseInt ( value , 10 ) ;
0 commit comments