From 2a64524e4841594b4c808bc8a5cd69bef9bc0abd Mon Sep 17 00:00:00 2001
From: Oskar Eichler <62393985+OskarEichler@users.noreply.github.com>
Date: Sat, 29 Aug 2026 21:18:41 +0200
Subject: [PATCH] Keep cookie jar storage separate from caller arrays

---
 lib/rack/test/cookie_jar.rb       | 2 +-
 spec/rack/test/cookie_jar_spec.rb | 9 +++++++++
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/lib/rack/test/cookie_jar.rb b/lib/rack/test/cookie_jar.rb
index c0c6e9b..80d88ab 100644
--- a/lib/rack/test/cookie_jar.rb
+++ b/lib/rack/test/cookie_jar.rb
@@ -136,7 +136,7 @@ class CookieJar # :nodoc:
 
       def initialize(cookies = [], default_host = DEFAULT_HOST)
         @default_host = default_host
-        @cookies = cookies.sort!
+        @cookies = cookies.sort
       end
 
       # Ensure the copy uses a distinct cookies array.
diff --git a/spec/rack/test/cookie_jar_spec.rb b/spec/rack/test/cookie_jar_spec.rb
index 854c582..405e6c4 100644
--- a/spec/rack/test/cookie_jar_spec.rb
+++ b/spec/rack/test/cookie_jar_spec.rb
@@ -6,6 +6,15 @@
   cookie_value = 'foo;abc'.freeze
   cookie_name = 'a_cookie_name'.freeze
 
+  it 'does not retain or mutate the supplied cookie array' do
+    cookies = [].freeze
+    jar = Rack::Test::CookieJar.new(cookies)
+    jar['a'] = 'b'
+
+    cookies.must_be_empty
+    jar.to_hash.must_equal 'a' => 'b'
+  end
+
   it 'copies should not share a cookie jar' do
     jar = Rack::Test::CookieJar.new
     jar_dup = jar.dup