# Rails 2.3.4 breaks if I set a cookie's value to a FixNum?

**URL:** <https://www.ruby-forum.com/t/rails-2-3-4-breaks-if-i-set-a-cookies-value-to-a-fixnum/177933>\
**Category:** Rails\
**Created:** [October 26, 2009, 10:07pm UTC](https://www.ruby-forum.com/t/rails-2-3-4-breaks-if-i-set-a-cookies-value-to-a-fixnum/177933 "2009-10-26T22:07:54Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![phallstrom](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/f475e1/32.png) [@phallstrom](https://www.ruby-forum.com/u/phallstrom)\
**Post date:** [October 26, 2009, 10:07pm UTC](https://www.ruby-forum.com/t/rails-2-3-4-breaks-if-i-set-a-cookies-value-to-a-fixnum/177933/1 "2009-10-26T22:07:54Z")

</div>

Hi all -

I just upgraded a project to 2.3.4  
(a54f572d6f994615a2053c361728b65520a1cb53) and I get errors if I set a  
cookie to a number like this:

cookies[‘foo’] = 123 # errors out on a call to CGI::escape(123)

* * *

## private method `gsub' called for 0:Fixnum /System/Library/Frameworks/Ruby.framework/Versions/1.8/usr/lib/ruby/ 1.8/cgi.rb:342:in`escape’ vendor/rails/actionpack/lib/action\_controller/cgi\_ext/cookie.rb:72:in `to_s' vendor/rails/actionpack/lib/action_controller/cgi_ext/cookie.rb:72:in`collect’ vendor/rails/actionpack/lib/action\_controller/cgi\_ext/cookie.rb:72:in `to_s' vendor/rails/actionpack/lib/action_controller/cookies.rb:92:in`set\_cookie’ vendor/rails/actionpack/lib/action\_controller/cookies.rb:73:in `[]=' app/controllers/application_controller.rb:33:in`set\_cookies’

## Digging through the code the offending method is below.

diff --git a/vendor/rails/actionpack/lib/action\_controller/cgi\_ext/  
cookie.rb b/vendor/rails/actionpack/lib/action\_controller/cgi\_ext/  
cookie.rb  
index 009ddd1…a8cb771 100755  
— a/vendor/rails/actionpack/lib/action\_controller/cgi\_ext/cookie.rb  
+++ b/vendor/rails/actionpack/lib/action\_controller/cgi\_ext/cookie.rb  
@@ -69,7 +69,7 @@ class CGI #:nodoc:  
def to\_s  
buf = ‘’  
buf \<\< @name \<\< ‘=’

- 

```
 buf << (@value.kind_of?(String) ? CGI::escape(@value) :

```

@value.collect{|v| CGI::escape(v) }.join("&"))

- 

```
 buf << (@value.kind_of?(String) ? CGI::escape(@value) :

```

## @value.collect{|v| CGI::escape(v.to\_s) }.join("&")) buf \<\< ‘; domain=’ \<\< @domain if @domain buf \<\< ‘; path=’ \<\< @path if @path buf \<\< ‘; expires=’ \<\< CGI::rfc1123\_date(@expires) if @expires

Couple of questions… CGI::escape’s source indicates it takes a  
string and does _zero_ checking before trying to call gsub on it. So  
why isn’t this method calling to\_s on the value? Is there a reason  
I’m not thinking of that it shouldn’t do this?  
Secondly, I tried to add a test to Rails to check this, but none of  
the cookie tests seem to touch this section of the code. Which seems  
odd to me and makes me wonder if I’m doing something wrong or if the  
tests simply don’t trigger this. However, if I make this change in my  
vendor/rails and hit my application it _does_ get called. Any ideas  
there?  
And lastly, is this worthy of a bug submission? Or was I living fast  
and loose thinking I could assign pure numbers to my cookies?  
Thanks!  
-philip

---

<div class="post-metadata">

**Author:** ![phallstrom](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/f475e1/32.png) [@phallstrom](https://www.ruby-forum.com/u/phallstrom)\
**Post date:** [October 26, 2009, 10:13pm UTC](https://www.ruby-forum.com/t/rails-2-3-4-breaks-if-i-set-a-cookies-value-to-a-fixnum/177933/2 "2009-10-26T22:13:10Z")

</div>

Hrm. I think I’m losing it… that github commit isn’t 2.3.4, but  
still the rest applies… I think. Heh.

---

<div class="post-metadata">

**Author:** ![phallstrom](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/f475e1/32.png) [@phallstrom](https://www.ruby-forum.com/u/phallstrom)\
**Post date:** [October 26, 2009, 10:31pm UTC](https://www.ruby-forum.com/t/rails-2-3-4-breaks-if-i-set-a-cookies-value-to-a-fixnum/177933/3 "2009-10-26T22:31:54Z")

</div>

All -

Sorry for the wasted bandwidth. Not sure what happened, but this  
isn’t relevant.

Sorry.