Lighttpd

Thanks. I'll try to review this patch later this week.

This appears to preserve the existing behavior of how whitespace is handled, and also fixes the issue you are seeing:

--- a/src/mod_accesslog.c
+++ b/src/mod_accesslog.c
@@ -1098,7 +1098,7 @@ REQUESTDONE_FUNC(log_access_write) {
                                                        buffer_free(bstr);
                                                        break;
                                                } else {
-                                                       do { ++str; } while (*str != ' ' && *str != '\t' && *str != '\0');
+                                                       do { ++str; } while (*str != ';' && *str != ' ' && *str != '\t' && *str != '\0');
                                                }
                                                while (*str == ' ' || *str == '\t') ++str;
                                        } while (*str++ == ';');

Sure, fix as you wish.

Your proposed change has a couple edge cases, though: an empty cookie (i.e. two semicolons in a row), skips the next cookie. And if the cookie value starts with semicolon and space, no cookies are read. These are very edge cases, so I can live with them :)

You don't have to be concernet with the witespace behaviour of my patch: whitespace is implicitly skipped as we only care to find the next semicolon. Indeed, could have used strchrnul to find the next semicolon, instead of the while loop.

I wasn't sure, but it seems empty cookies are allowed by the RFC [1]:

   4.  Serialize the cookie-list into a cookie-string by processing each
       cookie in the cookie-list in order:

       1.  Output the cookie's name, the %x3D ("=") character, and the
           cookie's value.

-->    2.  If there is an unprocessed cookie in the cookie-list, output
-->        the characters %x3B and %x20 ("; ").

[1] https://tools.ietf.org/html/rfc6265#section-5.4

strchrnul() is a GNU extension and is not as portable as C or POSIX standard library calls.

--- a/src/mod_accesslog.c
+++ b/src/mod_accesslog.c
@@ -1098,7 +1098,7 @@ REQUESTDONE_FUNC(log_access_write) {
                                                        buffer_free(bstr);
                                                        break;
                                                } else {
-                                                       do { ++str; } while (*str != ' ' && *str != '\t' && *str != '\0');
+                                                       while (*str != ';' && *str != ' ' && *str != '\t' && *str != '\0') ++str;
                                                }
                                                while (*str == ' ' || *str == '\t') ++str;
                                        } while (*str++ == ';');