Skip to content

Commit 24b5464

Browse files
committed
Security: only delete cookie if owned by an active service
1 parent 76151fa commit 24b5464

2 files changed

Lines changed: 39 additions & 3 deletions

File tree

‎tarteaucitron.js‎

Lines changed: 38 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2062,11 +2062,47 @@ var tarteaucitron = {
20622062
},
20632063
"purge": function (arr) {
20642064
"use strict";
2065-
var i;
2065+
2066+
var i,
2067+
j,
2068+
k,
2069+
service,
2070+
allowed,
2071+
rgxpCookie;
20662072

20672073
for (i = 0; i < arr.length; i += 1) {
20682074

2069-
var rgxpCookie = new RegExp("^(.*;)?\\s*" + arr[i] + "\\s*=\\s*[^;]+(.*)?$");
2075+
allowed = false;
2076+
2077+
if (tarteaucitron.parameters.cookieslist !== true && tarteaucitron.parameters.cookieslistEmbed !== true) {
2078+
2079+
for (j = 0; j < tarteaucitron.job.length; j += 1) {
2080+
2081+
service = tarteaucitron.services[tarteaucitron.job[j]];
2082+
2083+
if (service !== undefined && service.cookies !== undefined) {
2084+
2085+
for (k = 0; k < service.cookies.length; k += 1) {
2086+
2087+
if (service.cookies[k] === arr[i]) {
2088+
allowed = true;
2089+
break;
2090+
}
2091+
}
2092+
}
2093+
2094+
if (allowed) {
2095+
break;
2096+
}
2097+
}
2098+
2099+
if (!allowed) {
2100+
continue;
2101+
}
2102+
}
2103+
2104+
rgxpCookie = new RegExp("^(.*;)?\\s*" + arr[i] + "\\s*=\\s*[^;]+(.*)?$");
2105+
20702106
if (document.cookie.match(rgxpCookie)) {
20712107
document.cookie = arr[i] + '=; expires=Thu, 01 Jan 2000 00:00:00 GMT; path=/;';
20722108
document.cookie = arr[i] + '=; expires=Thu, 01 Jan 2000 00:00:00 GMT; path=/; domain=.' + location.hostname + ';';

‎tarteaucitron.min.js‎

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)