Fix cookiejar key handling and cleanup#3588
Conversation
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. 🗂️ Base branches to auto review (3)
Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
There was a problem hiding this comment.
Summary of Changes
Hello @gaby, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!
This pull request focuses on refining the CookieJar implementation by enhancing performance, optimizing memory usage, and correcting the logic for cookie path matching. The changes aim to make the cookie handling mechanism more robust, efficient, and compliant with standard cookie behavior.
Highlights
- Cookie Expiration Handling: Improved the efficiency of expired cookie removal within the
getCookiesByHostandparseCookiesFromRespfunctions by adopting the 'kept slice' technique. This avoids costly in-place slice manipulations and reallocations. - Cookie Jar Key Management: Optimized string key handling for the
hostCookiesmap by explicitly copying strings usingutils.CopyString. This prevents unnecessary string conversions and ensures that map keys are properly owned and stable, avoiding potential issues with string header reuse from temporary byte slices. - Cookie Path Matching Logic: Corrected the cookie lookup path matching in
searchCookieByKeyAndPathto use prefix logic (bytes.HasPrefix). This change ensures that cookies are matched according to standard HTTP cookie specifications, where a cookie with a given path should apply to all sub-paths.
Using Gemini Code Assist
The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.
Invoking Gemini
You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.
| Feature | Command | Description |
|---|---|---|
| Code Review | /gemini review |
Performs a code review for the current pull request in its current state. |
| Pull Request Summary | /gemini summary |
Provides a summary of the current pull request in its current state. |
| Comment | @gemini-code-assist | Responds in comments when explicitly tagged, both in issue comments and review comments. |
| Help | /gemini help |
Displays a list of available commands. |
Customization
To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.
Limitations & Feedback
Gemini Code Assist is currently in preview and may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments to provide feedback.
You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.
Footnotes
-
Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩
There was a problem hiding this comment.
Code Review
This pull request introduces some great cleanups and performance improvements to the cookie jar implementation. Using the "kept slice" technique for removing expired cookies is much more efficient and idiomatic Go. Similarly, ensuring map keys are safe copies with utils.CopyString is an important correctness fix. I've found one issue with the new cookie path matching logic. While it's an improvement over the previous exact match, it's still too permissive and doesn't fully align with RFC 6265. I've left a detailed comment with a suggested fix to make it more robust.
client/cookiejar.go
Outdated
| if bytes.HasPrefix(reqPath, cookiePath) { | ||
| return c | ||
| } |
There was a problem hiding this comment.
The updated path matching logic using bytes.HasPrefix is an improvement, but it's still too broad and doesn't fully comply with RFC 6265, Section 5.1.4. For example, a cookie with path=/api would incorrectly match a request to /apiv2. The path-match rule requires that if the cookie path is a prefix of the request path, the next character in the request path must be a /, unless the cookie path itself ends with a /. This could lead to cookies being sent to unintended endpoints, which can be a security risk. I suggest a more precise implementation of the path-matching logic that correctly handles these cases.
if bytes.HasPrefix(reqPath, cookiePath) {
// Path-match from RFC 6265 section 5.1.4
if len(reqPath) == len(cookiePath) || cookiePath[len(cookiePath)-1] == '/' || reqPath[len(cookiePath)] == '/' {
return c
}
}
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## 2025-07-03-15-08-43 #3588 +/- ##
=======================================================
+ Coverage 90.83% 90.88% +0.04%
=======================================================
Files 110 110
Lines 11132 11136 +4
=======================================================
+ Hits 10112 10121 +9
+ Misses 764 760 -4
+ Partials 256 255 -1
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
There was a problem hiding this comment.
⚠️ Performance Alert ⚠️
Possible performance regression was detected for benchmark.
Benchmark result of this commit is worse than the previous benchmark result exceeding threshold 1.50.
| Benchmark suite | Current: adefb7e | Previous: 2832ae3 | Ratio |
|---|---|---|---|
BenchmarkAppendMsgitem-4_middleware_csrf - MB/s |
2982.96 MB/s |
1604.67 MB/s |
1.86 |
BenchmarkAppendMsgstorageManager |
0.6216 ns/op 1608.86 MB/s 0 B/op 0 allocs/op |
0.312 ns/op 3204.71 MB/s 0 B/op 0 allocs/op |
1.99 |
BenchmarkAppendMsgstorageManager - ns/op |
0.6216 ns/op |
0.312 ns/op |
1.99 |
This comment was automatically generated by workflow using github-action-benchmark.
|
/gemini review |
There was a problem hiding this comment.
Code Review
This pull request enhances the cookiejar functionality by improving expired cookie handling, fixing path matching, and ensuring safer map key handling. Code clarity is improved by simplifying string conversions, and resource leaks are prevented in the new test case.
Summary