kawasima · Mar 8, 2026 · Mar 8, 2026 · Mar 8, 2026 · Mar 8, 2026 · Mar 8, 2026
diff --git a/CLAUDE.md b/CLAUDE.md
@@ -18,7 +18,7 @@ Improvement proposals and architectural decisions are tracked as GitHub Issues.
 
 Apply this checklist both when reviewing others' code **and** before submitting your own changes.
 
-- Verify all branches for malformed/invalid input, not just the happy path.
+- Verify all branches for malformed/invalid input, not just the happy path. **This applies to tests too**: confirm that each test actually exercises the code path it claims — e.g. don't percent-encode chars when testing a regex that runs on the raw string.
 - When multiple parsing strategies exist (e.g. quoted vs. unquoted), ensure malformed input in one strategy does not silently fall through to another and produce a wrong result.
 - When extending the scope of a utility function (e.g. adding new types to a filter), trace all call sites to verify that downstream behavior is correct for the new inputs — not just the entry point.
 - String comparisons against HTTP header values (media types, field names) must be case-insensitive per the relevant RFC. Verify that `equalsIgnoreCase`, `toLowerCase(Locale.ROOT)`, or `regionMatches(true, ...)` is used appropriately.

diff --git a/enkan-web/src/main/java/enkan/middleware/CookiesMiddleware.java b/enkan-web/src/main/java/enkan/middleware/CookiesMiddleware.java
@@ -22,9 +22,13 @@
  */
 @Middleware(name = "cookies")
 public class CookiesMiddleware implements WebMiddleware {
-    private static final Pattern RE_COOKIE_OCTET = Pattern.compile("[!#$%&'()*+\\-./0-9:<=>?@A-Z\\[\\]\\^_`a-z\\{\\|\\}~]");
-    private static final Pattern RE_COOKIE_VALUE = Pattern.compile("\"" + RE_COOKIE_OCTET.pattern() +  "*\"|" + RE_COOKIE_OCTET.pattern() + "*");
-    private static final Pattern RE_COOKIE = Pattern.compile("\\s*(" + RE_TOKEN + ")=(" + RE_COOKIE_VALUE.pattern() + ")\\s*[;,]?");
+    // RFC 6265 §4.1.1: cookie-octet = %x21 / %x23-2B / %x2D-3A / %x3C-5B / %x5D-7E
+    // Backslash (%x5C) and double-quote (%x22) are explicitly excluded.
+    private static final Pattern RE_COOKIE_OCTET = Pattern.compile("[\\x21\\x23-\\x2B\\x2D-\\x3A\\x3C-\\x5B\\x5D-\\x7E]");
+    private static final Pattern RE_COOKIE_VALUE = Pattern.compile("\"" + RE_COOKIE_OCTET.pattern() + "*\"|" + RE_COOKIE_OCTET.pattern() + "*");
+    // Require the value to be followed by a valid delimiter or end-of-input so that
+    // non cookie-octet chars after the value (e.g. backslash) prevent a match entirely.
+    private static final Pattern RE_COOKIE = Pattern.compile("\\s*(" + RE_TOKEN + ")=(" + RE_COOKIE_VALUE.pattern() + ")\\s*(?:[;,]|$)");
 
     /**
      * Strip quotes from argument string.

diff --git a/enkan-web/src/test/java/enkan/middleware/CookiesMiddlewareTest.java b/enkan-web/src/test/java/enkan/middleware/CookiesMiddlewareTest.java
@@ -63,4 +63,35 @@ void parse() {
         request.getHeaders().put("Cookie", "A=%E3%81%82%E3%81%84%E3%81%86; B=1");
         middleware.handle(request, chain);
     }
+
+    @Test
+    void parsesRfcValidCookieOctets() {
+        // RFC 6265 §4.1.1: spot-check one char from each allowed range using raw octets.
+        // %x21=!, %x23=#, %x2D=-, %x3A=:, %x3C=<, %x5B=[, %x5D=], %x7E=~
+        // Chars that have special meaning for form-decoding (+ as space, % as escape) are omitted.
+        final String expectedValue = "!#-:<[]~";
+        MiddlewareChain<HttpRequest, HttpResponse, ?, ?> chain = new DefaultMiddlewareChain<>(new AnyPredicate<>(), null,
+                (Endpoint<HttpRequest, HttpResponse>) req -> {
+                    Cookie cookie = req.getCookies().get("A");
+                    assertThat(cookie).isNotNull();
+                    assertThat(cookie.getValue()).isEqualTo(expectedValue);
+                    return HttpResponse.of("ok");
+                });
+        request.getHeaders().put("Cookie", "A=!#-:<[]~");
+        middleware.handle(request, chain);
+    }
+
+    @Test
+    void backslashIsNotConsumedAsCookieOctet() {
+        // Backslash (%x5C) is not a valid cookie-octet (RFC 6265 §4.1.1).
+        // RE_COOKIE requires the value to be followed by a delimiter or end-of-input,
+        // so BAD=\ (a trailing backslash) does not match and the cookie is not parsed at all.
+        MiddlewareChain<HttpRequest, HttpResponse, ?, ?> chain = new DefaultMiddlewareChain<>(new AnyPredicate<>(), null,
+                (Endpoint<HttpRequest, HttpResponse>) req -> {
+                    assertThat(req.getCookies()).doesNotContainKey("BAD");
+                    return HttpResponse.of("ok");
+                });
+        request.getHeaders().put("Cookie", "BAD=\\");
+        middleware.handle(request, chain);
+    }
 }