Fix signedCookie to return undefined for non-string arguments

closes #18
expressjs · Sep 18, 2015 · 8a9907d · 8a9907d
1 parent 54c8977
commit 8a9907d
Show file tree

Hide file tree

Showing 3 changed files with 14 additions and 0 deletions.
diff --git a/HISTORY.md b/HISTORY.md
@@ -2,6 +2,7 @@ unreleased
 ==========
 
   * Fix `JSONCookie` to return `undefined` for non-string arguments
+  * Fix `signedCookie` to return `undefined` for non-string arguments
   * deps: cookie@0.1.5
 
 1.3.5 / 2015-05-19

diff --git a/index.js b/index.js
@@ -117,6 +117,10 @@ function JSONCookies(obj) {
  */
 
 function signedCookie(str, secret) {
+  if (typeof str !== 'string') {
+    return undefined;
+  }
+
   return str.substr(0, 2) === 's:'
     ? signature.unsign(str.slice(2), secret)
     : str;

diff --git a/test/cookieParser.js b/test/cookieParser.js
@@ -139,6 +139,15 @@ describe('cookieParser.JSONCookie(str)', function () {
 })
 
 describe('cookieParser.signedCookie(str, secret)', function () {
+  it('should return undefined for non-string arguments', function () {
+    assert.strictEqual(cookieParser.signedCookie(undefined, 'keyboard cat'), undefined)
+    assert.strictEqual(cookieParser.signedCookie(null, 'keyboard cat'), undefined)
+    assert.strictEqual(cookieParser.signedCookie(42, 'keyboard cat'), undefined)
+    assert.strictEqual(cookieParser.signedCookie({}, 'keyboard cat'), undefined)
+    assert.strictEqual(cookieParser.signedCookie([], 'keyboard cat'), undefined)
+    assert.strictEqual(cookieParser.signedCookie(function(){}, 'keyboard cat'), undefined)
+  })
+
   it('should pass through non-signed string', function () {
     assert.strictEqual(cookieParser.signedCookie('', 'keyboard cat'), '')
     assert.strictEqual(cookieParser.signedCookie('foo', 'keyboard cat'), 'foo')