<p dir="auto">RFC 6265[1] allows cookie values to be double-quoted[2].  However, the current sanitization code strips the double quotes out of a double-quoted value (i.e., a value beginning with a double quote and ending with a double quote).  Ironically, the sanitization code double quotes a value if it begins or ends with a space or comma.  The RFC grammar specification allowing the surrounding double quotes is also included in the comments of the sanitizeCookieValue() function.</p>
<p dir="auto">The inability to double-quote a cookie value is preventing me from duplicating the behavior of a legacy Java system I am replacing.</p>
<p dir="auto">There was some tangentially related conversation for <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="51286407" data-permission-text="Title is private" data-url="https://github.com/golang/go/issues/7243" data-hovercard-type="issue" data-hovercard-url="/golang/go/issues/7243/hovercard" href="https://github.com/golang/go/issues/7243">#7243</a>, but that conversation did not address this issue specifically.</p>
<p dir="auto">[1] <a href="http://tools.ietf.org/html/rfc6265" rel="nofollow">http://tools.ietf.org/html/rfc6265</a><br>
[2] cookie-value = *cookie-octet / ( DQUOTE *cookie-octet DQUOTE )</p>
<pre class="notranslate">What steps will reproduce the problem?
1.build this program with gomake
2.run leak4 m /tmp/x (server)
3.run leak4 e /tmp/x (client)
4. Observe that each time you run 'leak4 e', the 'leak4 m' grows by about 1.5m. It will
continue to grow until the OOM killer is invoked. 

What is the expected output?

leak4 m should stabilize at some reasonable size (although 5M for something this simply
is not necessarily reasonable)

What do you see instead?
leak4 grows without bound

What is your $GOOS?  $GOARCH?
linux/i386

Which revision are you using?  (hg identify)
0702e278ff73+ tip

Please provide any additional information below.

rminnich@vmatic:~/clustermatic/goproc$ ./leak4 e /tmp/x
rminnich@vmatic:~/clustermatic/goproc$ ps axl | grep leak4
0  1000  2950 30465  20   0   4568  1748 signal T    pts/0      0:00 vi leak4.go
0  1000  3036 30657  20   0   1996   720 wait   S+   pts/1      0:00 strace -o mx -f
./leak4 m /tmp/x
0  1000  3037  3036  20   0   5660  3584 futex_ Sl+  pts/1      0:00 ./leak4 m /tmp/x
0  1000  3042 30465  20   0   3324   816 pipe_w S+   pts/0      0:00 grep --color=auto
leak4
rminnich@vmatic:~/clustermatic/goproc$ ./leak4 e /tmp/x
rminnich@vmatic:~/clustermatic/goproc$ ps axl | grep leak4
0  1000  2950 30465  20   0   4568  1748 signal T    pts/0      0:00 vi leak4.go
0  1000  3036 30657  20   0   1996   720 wait   S+   pts/1      0:00 strace -o mx -f
./leak4 m /tmp/x
0  1000  3037  3036  20   0   7780  5680 futex_ Sl+  pts/1      0:00 ./leak4 m /tmp/x
0  1000  3047 30465  20   0   3324   816 pipe_w S+   pts/0      0:00 grep --color=auto
leak4
rminnich@vmatic:~/clustermatic/goproc$</pre>
<p dir="auto">Attachments:</p>
<ol dir="auto">
<li><a href="https://storage.googleapis.com/go-attachment/1091/0/leak4.go" rel="nofollow">leak4.go</a> (537 bytes)</li>
</ol>