2 files changed, 42 insertions, 14 deletions
diff --git a/custom/extensions/auth-file.lua b/custom/extensions/auth-file.lua
index aef7190..90f597b 100644
--- a/custom/extensions/auth-file.lua
+++ b/custom/extensions/auth-file.lua
@@ -98,8 +98,19 @@ local action, http, cgit, post
 -- The two lookups below, account_hash and repo_userset, are the only part
 -- of this script that differs from auth-inline.lua.
 
-local function trim(s)
-	return (string.gsub(s, "^%s*(.-)%s*$", "%1"))
+-- Lua patterns backtrack, so "^%s*(.-)%s*$" costs the square of a run of
+-- spaces inside the text. Finding each end directly stays linear, which
+-- matters for the Cookie header a visitor writes.
+local function trim(text)
+	local first = text:find("%S")
+	if first == nil then
+		return ""
+	end
+	local last = #text
+	while text:find("^%s", last) do
+		last = last - 1
+	end
+	return text:sub(first, last)
 end
 
 local function add_names(list, set)
@@ -210,16 +221,17 @@ function parse_query(query)
 	return params
 end
 
-local function pattern_escape(s)
-	return (string.gsub(s, "([%^%$%(%)%%%.%[%]%*%+%-%?])", "%%%1"))
-end
-
 -- The token comes back still URL encoded by secure_value. Decoding it here
 -- would break the signature check for any value carrying a percent escape.
--- The name is escaped because it lands in a Lua pattern.
 function get_cookie(cookies, name)
-	cookies = string.gsub(";" .. (cookies or "") .. ";", "%s*;%s*", ";")
-	return string.match(cookies, ";" .. pattern_escape(name) .. "=(.-);")
+	for raw in string.gmatch(cookies or "", "[^;]+") do
+		local pair = trim(raw)
+		local equals = pair:find("=", 1, true)
+		if equals and pair:sub(1, equals - 1) == name then
+			return pair:sub(equals + 1)
+		end
+	end
+	return nil
 end
 
 function tohex(bytes)
diff --git a/custom/extensions/auth-inline.lua b/custom/extensions/auth-inline.lua
index 5363a38..de91f88 100644
--- a/custom/extensions/auth-inline.lua
+++ b/custom/extensions/auth-inline.lua
@@ -168,16 +168,32 @@ function parse_query(query)
 	return params
 end
 
-local function pattern_escape(s)
-	return (string.gsub(s, "([%^%$%(%)%%%.%[%]%*%+%-%?])", "%%%1"))
+-- Lua patterns backtrack, so "^%s*(.-)%s*$" costs the square of a run of
+-- spaces inside the text. Finding each end directly stays linear, which
+-- matters for the Cookie header a visitor writes.
+local function trim(text)
+	local first = text:find("%S")
+	if first == nil then
+		return ""
+	end
+	local last = #text
+	while text:find("^%s", last) do
+		last = last - 1
+	end
+	return text:sub(first, last)
 end
 
 -- The token comes back still URL encoded by secure_value. Decoding it here
 -- would break the signature check for any value carrying a percent escape.
--- The name is escaped because it lands in a Lua pattern.
 function get_cookie(cookies, name)
-	cookies = string.gsub(";" .. (cookies or "") .. ";", "%s*;%s*", ";")
-	return string.match(cookies, ";" .. pattern_escape(name) .. "=(.-);")
+	for raw in string.gmatch(cookies or "", "[^;]+") do
+		local pair = trim(raw)
+		local equals = pair:find("=", 1, true)
+		if equals and pair:sub(1, equals - 1) == name then
+			return pair:sub(equals + 1)
+		end
+	end
+	return nil
 end
 
 function tohex(bytes)