{"record":{"id":"a6009b6c2b310ccd","repo":"quarkusio/quarkus","slug":"invalid-escape-character-in-cookie-value","errorCode":null,"errorMessage":"Invalid escape character in cookie value","messagePattern":"Invalid escape character in cookie value","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"independent-projects/resteasy-reactive/common/runtime/src/main/java/org/jboss/resteasy/reactive/common/headers/ServerCookie.java","lineNumber":275,"sourceCode":"     * @param s the input string\n     * @param beginIndex start index inclusive\n     * @param endIndex exclusive\n     * @return The (possibly) escaped string\n     */\n    private static String escapeDoubleQuotes(String s, int beginIndex, int endIndex) {\n\n        if (s == null || s.length() == 0 || s.indexOf('\"') == -1) {\n            return s;\n        }\n\n        StringBuffer b = new StringBuffer();\n        for (int i = beginIndex; i < endIndex; i++) {\n            char c = s.charAt(i);\n            if (c == '\\\\') {\n                b.append(c);\n                //ignore the character after an escape, just append it\n                if (++i >= endIndex)\n                    throw new IllegalArgumentException(\"Invalid escape character in cookie value\");\n                b.append(s.charAt(i));\n            } else if (c == '\"')\n                b.append('\\\\').append('\"');\n            else\n                b.append(c);\n        }\n\n        return b.toString();\n    }\n\n}\n","sourceCodeStart":257,"sourceCodeEnd":287,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/independent-projects/resteasy-reactive/common/runtime/src/main/java/org/jboss/resteasy/reactive/common/headers/ServerCookie.java#L257-L287","documentation":"When ServerCookie escapes double quotes in a cookie value (escapeDoubleQuotes), a backslash is treated as an escape character; if a backslash is the last character before the closing boundary there is no following character to keep, indicating a malformed escaped value, so IllegalArgumentException is thrown.","triggerScenarios":"A cookie value ending with a trailing backslash that also requires quoting (e.g. value \"abc\\\\\" passed through maybeQuote2 with alreadyQuoted false but isToken false, or an already-quoted value like \"\\\"abc\\\\\\\"\" with an unpaired escape) — the escape loop advances past a backslash and hits the end index.","commonSituations":"Windows-style path strings stored in cookies (trailing backslash); Base64 or serialized values ending in '\\\\'; values that were partially escaped earlier and re-escaped on the way out.","solutions":["Strip or escape trailing backslashes in cookie values before setting them (e.g. value.replaceAll(\"\\\\\\\\+$\", \"\") or double-escape them).","URL-encode the value so backslashes never appear raw in cookie values.","Fix double-escaping: ensure the value is escaped exactly once in its lifecycle (avoid escaping already-quoted values again).","Catch IllegalArgumentException around cookie serialization to log and reject the offending value."],"exampleFix":"// before\nNewCookie c = new NewCookie(\"path\", \"C:\\\\dir\\\\\"); // trailing backslash breaks escaping\n// after\nString safe = raw.replaceAll(\"\\\\\\\\+$\", \"\"); // drop trailing backslash\nNewCookie c = new NewCookie(\"path\", URLEncoder.encode(safe, StandardCharsets.UTF_8));","handlingStrategy":"validation","validationCode":"static String escapeForCookie(String v) {\n    return v == null ? \"\" : v.replace(\"\\\\\", \"\\\\\\\\\").replaceAll(\"\\\\\\\\+$\", \"\\\\\\\\\\\\\\\\\");\n}","typeGuard":"static boolean hasBalancedEscapes(String v) {\n    return v == null || !(v.length() > 0 && v.charAt(v.length() - 1) == '\\\\');\n}","tryCatchPattern":"try {\n    ServerCookie.maybeQuote2(0, buf, value);\n} catch (IllegalArgumentException e) {\n    log.warn(\"Cookie value has invalid escape: {}\", value);\n    buf.append('\\\"').append(URLEncoder.encode(value, StandardCharsets.UTF_8)).append('\\\"');\n}","preventionTips":["URL-encode cookie values so backslashes never survive raw.","Avoid storing path-like strings (Windows paths) in cookies directly.","Escape cookie values exactly once — never re-escape already-escaped/quoted values.","Add a regression test for values ending in backslash."],"tags":["http","cookie","escaping","validation"],"backgroundTag":"invalid-cookie-value","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}