Cookie#max_age= should reject malformed strings.

lib/http/cookie.rb

@@ -195,7 +195,7 @@ class HTTP::Cookie
         origin = val
       when 'max_age'
         # Let max_age take precedence over expires
-        max_age = val if val
+        max_age = val
       else
         setter = :"#{skey}="
         __send__(setter, val) if respond_to?(setter)
@@ -494,6 +494,8 @@ class HTTP::Cookie
     else
       str = check_string_type(sec) or
         raise TypeError, "#{sec.class} is not an Integer or String"
+      /\A-?\d+\z/.match(str) or
+        raise ArgumentError, "invalid Max-Age: #{sec.inspect}"
       sec = str.to_i
     end
     if @session = sec.nil?

test/test_http_cookie.rb

@@ -586,6 +586,28 @@ class TestHTTPCookie < Test::Unit::TestCase
     assert_equal true, cookie.expired?
   end
 
+  def test_max_age=
+    cookie = HTTP::Cookie.new(cookie_values)
+
+    assert_raises(ArgumentError) {
+      cookie.max_age = "+1"
+    }
+    assert_raises(ArgumentError) {
+      cookie.max_age = "1.5"
+    }
+    assert_raises(ArgumentError) {
+      cookie.max_age = "1 day"
+    }
+    assert_raises(TypeError) {
+      cookie.max_age = [1]
+    }
+    cookie.max_age = "12"
+    assert_equal 12, cookie.max_age
+
+    cookie.max_age = -3
+    assert_equal -3, cookie.max_age
+  end
+
   def test_session
     cookie = HTTP::Cookie.new(cookie_values)