From 5dc2e19e15d48338f23a372e9d1998617733b4eb Mon Sep 17 00:00:00 2001 From: Pavan Kumar Reddy B Date: Fri, 10 Jul 2026 10:56:14 +0530 Subject: [PATCH 1/7] RDKB-65950 Fix HTTP login session cookie Secure flag handling --- jsts/jst_prefix.js | 25 +++++++++++++++++-------- 1 file changed, 17 insertions(+), 8 deletions(-) diff --git a/jsts/jst_prefix.js b/jsts/jst_prefix.js index 8f3a778..7a3eb81 100644 --- a/jsts/jst_prefix.js +++ b/jsts/jst_prefix.js @@ -89,6 +89,17 @@ var $_SERVER = new Proxy({}, { var $_SESSION = {}; var $_jst_session = null; var $_val_input = {}; + +function is_https_request() +{ + var https = getenv('HTTPS'); + if(https === false || https === undefined || https === null) + return false; + + var value = String(https).toLowerCase(); + return (value === 'on' || value === '1' || value === 'true'); +} + function session_start() { if($_jst_session) @@ -99,11 +110,10 @@ function session_start() return; } ccsp_session.start(); - var host = getenv('HTTPS'); - if (host == false) - var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly"; - else + if (is_https_request()) var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly"; + else + var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly"; header($cookie); $_jst_session = ccsp_session.getData(); $_SESSION = new Proxy($_jst_session, { @@ -127,11 +137,10 @@ function session_start() } function session_create(){ ccsp_session.create(); - var host = getenv('HTTPS'); - if (host == false) - var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly"; - else + if (is_https_request()) var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly"; + else + var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly"; header($cookie); $_jst_session = ccsp_session.getData(); $_SESSION = new Proxy($_jst_session, { From 60a316de6ec85a883cd696118f0c32d31dde50eb Mon Sep 17 00:00:00 2001 From: Pavan Kumar Reddy B Date: Fri, 10 Jul 2026 11:01:31 +0530 Subject: [PATCH 2/7] RDKB-65950 Align HTTPS cookie conditional indentation --- jsts/jst_prefix.js | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/jsts/jst_prefix.js b/jsts/jst_prefix.js index 7a3eb81..0cfde73 100644 --- a/jsts/jst_prefix.js +++ b/jsts/jst_prefix.js @@ -110,10 +110,10 @@ function session_start() return; } ccsp_session.start(); - if (is_https_request()) - var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly"; - else - var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly"; + if (is_https_request()) + var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly"; + else + var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly"; header($cookie); $_jst_session = ccsp_session.getData(); $_SESSION = new Proxy($_jst_session, { From 73f5a83b02478c881562658e781dcc08238beb6c Mon Sep 17 00:00:00 2001 From: Pavan Kumar Reddy B Date: Fri, 17 Jul 2026 12:48:36 +0530 Subject: [PATCH 3/7] declare cookie once in session helpers --- jsts/jst_prefix.js | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/jsts/jst_prefix.js b/jsts/jst_prefix.js index 0cfde73..3ebfb1e 100644 --- a/jsts/jst_prefix.js +++ b/jsts/jst_prefix.js @@ -110,10 +110,10 @@ function session_start() return; } ccsp_session.start(); + var $session_id = ccsp_session.getId(); + var $cookie = "Set-Cookie: DUKSID=" + $session_id + "; httponly"; if (is_https_request()) - var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly"; - else - var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly"; + $cookie = "Set-Cookie: DUKSID=" + $session_id + "; secure; httponly"; header($cookie); $_jst_session = ccsp_session.getData(); $_SESSION = new Proxy($_jst_session, { @@ -137,10 +137,10 @@ function session_start() } function session_create(){ ccsp_session.create(); + var $session_id = ccsp_session.getId(); + var $cookie = "Set-Cookie: DUKSID=" + $session_id + "; httponly"; if (is_https_request()) - var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; secure" + "; httponly"; - else - var $cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; httponly"; + $cookie = "Set-Cookie: DUKSID=" + $session_id + "; secure; httponly"; header($cookie); $_jst_session = ccsp_session.getData(); $_SESSION = new Proxy($_jst_session, { From 16cd1e1104d693cbb023252bf3b1ef4908af256d Mon Sep 17 00:00:00 2001 From: Pavan Kumar Reddy B Date: Fri, 17 Jul 2026 13:02:24 +0530 Subject: [PATCH 4/7] inline session ID in Set-Cookie header construction --- jsts/jst_prefix.js | 14 ++++---------- 1 file changed, 4 insertions(+), 10 deletions(-) diff --git a/jsts/jst_prefix.js b/jsts/jst_prefix.js index 3ebfb1e..ed4ddcc 100644 --- a/jsts/jst_prefix.js +++ b/jsts/jst_prefix.js @@ -110,11 +110,8 @@ function session_start() return; } ccsp_session.start(); - var $session_id = ccsp_session.getId(); - var $cookie = "Set-Cookie: DUKSID=" + $session_id + "; httponly"; - if (is_https_request()) - $cookie = "Set-Cookie: DUKSID=" + $session_id + "; secure; httponly"; - header($cookie); + var cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; HttpOnly" + (is_https_request() ? "; Secure" : ""); + header(cookie); $_jst_session = ccsp_session.getData(); $_SESSION = new Proxy($_jst_session, { get: function(obj, prop) { @@ -137,11 +134,8 @@ function session_start() } function session_create(){ ccsp_session.create(); - var $session_id = ccsp_session.getId(); - var $cookie = "Set-Cookie: DUKSID=" + $session_id + "; httponly"; - if (is_https_request()) - $cookie = "Set-Cookie: DUKSID=" + $session_id + "; secure; httponly"; - header($cookie); + var cookie = "Set-Cookie: DUKSID=" + ccsp_session.getId() + "; HttpOnly" + (is_https_request() ? "; Secure" : ""); + header(cookie); $_jst_session = ccsp_session.getData(); $_SESSION = new Proxy($_jst_session, { get: function(obj, prop) { From 3922faed094fbc3179ecda322e00999f294fcf2d Mon Sep 17 00:00:00 2001 From: Pavan Kumar Reddy B Date: Mon, 20 Jul 2026 14:33:39 +0530 Subject: [PATCH 5/7] free session_identifier on start failure to prevent empty cookie --- source/jst_session.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/source/jst_session.c b/source/jst_session.c index 69f542f..c1074d3 100644 --- a/source/jst_session.c +++ b/source/jst_session.c @@ -148,6 +148,8 @@ static duk_ret_t session_start(duk_context *ctx) if(!session_identifier[0]) { CosaPhpExtLog("Invalid Session\n"); + free(session_identifier); + session_identifier = NULL; RETURN_FALSE; } From 4c86f67b94357f7560b15cbdc556ccd97dcaa1a7 Mon Sep 17 00:00:00 2001 From: Pavan Kumar Reddy B Date: Mon, 20 Jul 2026 14:49:18 +0530 Subject: [PATCH 6/7] build: update dbus dependency branch to 1.14.10-3-1deepin3 --- cov_docker_script/component_config.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cov_docker_script/component_config.json b/cov_docker_script/component_config.json index c4d738f..13ca66b 100644 --- a/cov_docker_script/component_config.json +++ b/cov_docker_script/component_config.json @@ -76,7 +76,7 @@ { "name": "dbus", "repo": "https://github.com/deepin-community/dbus.git", - "branch" : "master", + "branch" : "1.14.10-3-1deepin3", "build": { "type": "cmake", "build_dir": "build", From 9532e685f493c33497a04f91675d9f5e6ec0f72e Mon Sep 17 00:00:00 2001 From: Pavan Kumar Reddy B Date: Mon, 20 Jul 2026 15:14:15 +0530 Subject: [PATCH 7/7] Revert "build: update dbus dependency branch to 1.14.10-3-1deepin3" This reverts commit 4c86f67b94357f7560b15cbdc556ccd97dcaa1a7. --- cov_docker_script/component_config.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cov_docker_script/component_config.json b/cov_docker_script/component_config.json index 13ca66b..c4d738f 100644 --- a/cov_docker_script/component_config.json +++ b/cov_docker_script/component_config.json @@ -76,7 +76,7 @@ { "name": "dbus", "repo": "https://github.com/deepin-community/dbus.git", - "branch" : "1.14.10-3-1deepin3", + "branch" : "master", "build": { "type": "cmake", "build_dir": "build",