From 930ee4c9bea9519f0b7589c46a5cc88998107180 Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Fri, 30 Oct 2026 19:08:44 -0700 Subject: Strip control characters from the location alone set_cookie only ever writes an empty value or a token secure_value built from url-encoded text, digits and hex, so stripping it changed nothing. --- tests/extensions/test-auth.lua | 2 -- 1 file changed, 2 deletions(-) (limited to 'tests') diff --git a/tests/extensions/test-auth.lua b/tests/extensions/test-auth.lua index 48c2add..07c7341 100644 --- a/tests/extensions/test-auth.lua +++ b/tests/extensions/test-auth.lua @@ -161,8 +161,6 @@ h.check("a scheme relative target is not", not is_safe_redirect("//evil")) h.check("a backslash variant is not", not is_safe_redirect("/\\evil")) h.check("a missing target is not", not is_safe_redirect(nil)) -h.equals("control characters are stripped from header values", strip_controls("a\r\nb"), "ab") - -- Signing and verification. local now = os.time() -- cgit 2.12.1