CRLF injection in cookie domain/path options in hackney

@@ -46,11 +46,24 @@ setcookie(Name, Value, Opts) ->
               end,
   DomainBin = case lists:keyfind(domain, 1, Opts) of
                 false -> <<>>;
-                {_, Domain} -> [<<"; Domain=">>, Domain]
+                {_, Domain} ->
+                  %% GHSA-mp55: Name/Value are guarded above; Domain and
+                  %% Path must reject the same line-terminating bytes (and
+                  %% ';', which would start a new attribute) so a
+                  %% request-derived domain/path cannot inject a second
+                  %% Set-Cookie header.
+                  nomatch = binary:match(iolist_to_binary(Domain),
+                                         [<<$;>>, <<$\s>>, <<$\t>>, <<$\r>>,
+                                          <<$\n>>, <<$\013>>, <<$\014>>, <<0>>]),
+                  [<<"; Domain=">>, Domain]
               end,
   PathBin = case lists:keyfind(path, 1, Opts) of
               false -> <<>>;
-              {_, Path} -> [<<"; Path=">>, Path]
+              {_, Path} ->
+                nomatch = binary:match(iolist_to_binary(Path),
+                                       [<<$;>>, <<$\r>>, <<$\n>>,
+                                        <<$\013>>, <<$\014>>, <<0>>]),
+                [<<"; Path=">>, Path]
             end,
   SecureBin = case lists:keyfind(secure, 1, Opts) of
                 false -> <<>>;

@@ -99,3 +99,20 @@ setcookie_failures_test_() ->
     [{iolist_to_binary(io_lib:format("{~p, ~p} failure", [N, V])),
       fun() -> true = F(N, V) end}
      || {N, V} <- Tests].
+
+%% GHSA-mp55: domain/path options must reject CR/LF/VT/FF/';' so a
+%% request-derived value cannot split the Set-Cookie header.
+setcookie_domain_path_injection_test_() ->
+    F = fun(Opts) ->
+            try hackney_cookie:setcookie(<<"sid">>, <<"abc">>, Opts) of
+                _ -> false
+            catch _:_ -> true
+            end
+    end,
+    Tests = [
+            {"path CRLF", [{path, <<"/x\r\nSet-Cookie: admin=1; Path=/">>}]},
+            {"path semicolon", [{path, <<"/x; Domain=evil">>}]},
+            {"domain CRLF", [{domain, <<"x.example\r\nSet-Cookie: a=1">>}]},
+            {"domain space", [{domain, <<"x.example evil">>}]}
+            ],
+    [{Name, fun() -> true = F(Opts) end} || {Name, Opts} <- Tests].