Fix expires option to reject invalid dates

jshttp · Mar 29, 2022 · 042073f · 042073f
1 parent 7fab32e
commit 042073f
Show file tree

Hide file tree

Showing 3 changed files with 22 additions and 2 deletions.
diff --git a/HISTORY.md b/HISTORY.md
@@ -2,6 +2,7 @@ unreleased
 ==========
 
   * Add `priority` option
+  * Fix `expires` option to reject invalid dates
 
 0.4.2 / 2022-02-02
 ==================

diff --git a/index.js b/index.js
@@ -20,6 +20,7 @@ exports.serialize = serialize;
  * @private
  */
 
+var __toString = Object.prototype.toString
 var decode = decodeURIComponent;
 var encode = encodeURIComponent;
 
@@ -145,11 +146,13 @@ function serialize(name, val, options) {
   }
 
   if (opt.expires) {
-    if (typeof opt.expires.toUTCString !== 'function') {
+    var expires = opt.expires
+
+    if (!isDate(expires) || isNaN(expires.valueOf())) {
       throw new TypeError('option expires is invalid');
     }
 
-    str += '; Expires=' + opt.expires.toUTCString();
+    str += '; Expires=' + expires.toUTCString()
   }
 
   if (opt.httpOnly) {
@@ -205,6 +208,18 @@ function serialize(name, val, options) {
   return str;
 }
 
+/**
+ * Determine if value is a Date.
+ *
+ * @param {*} val
+ * @private
+ */
+
+function isDate (val) {
+  return __toString.call(val) === '[object Date]' ||
+    val instanceof Date
+}
+
 /**
  * Try decoding a string using a decoding function.
  *

diff --git a/test/serialize.js b/test/serialize.js
@@ -67,6 +67,10 @@ test('expires', function() {
   assert.throws(cookie.serialize.bind(cookie, 'foo', 'bar', {
     expires: Date.now()
   }), /option expires is invalid/);
+
+  assert.throws(cookie.serialize.bind(cookie, 'foo', 'bar', {
+    expires: new Date(NaN)
+  }), /option expires is invalid/)
 });
 
 test('priority', function () {