[drupal-devel] [bug] drupal_http_request improper handles set-cookie headers
Issue status update for http://drupal.org/node/28629 Post a follow up: http://drupal.org/project/comments/add/28629 Project: Drupal Version: cvs Component: base system Category: bug reports Priority: critical Assigned to: chx Reported by: chx Updated by: chx Status: patch (code needs review) Attachment: http://drupal.org/files/issues/resp.patch (775 bytes) This is an issue with cookies: when you get multiple response headers with the same name, they are overridden. This is probably what we want for location but for set-cookie this is bad. So says RFC 2109: " Informally, the Set-Cookie response header comprises the token Set- Cookie:, followed by a comma-separated list of one or more cookies. " chx
Issue status update for http://drupal.org/node/28629 Post a follow up: http://drupal.org/project/comments/add/28629 Project: Drupal Version: cvs Component: base system Category: bug reports Priority: critical Assigned to: chx Reported by: chx Updated by: killes@www.drop.org -Status: patch (code needs review) +Status: patch (ready to be committed) according to the cited RFC I believe this to be correct. The patch does apply and does not cause parse errors. ;) killes@www.drop.org Previous comments: ------------------------------------------------------------------------ Wed, 10 Aug 2005 17:42:33 +0000 : chx Attachment: http://drupal.org/files/issues/resp.patch (775 bytes) This is an issue with cookies: when you get multiple response headers with the same name, they are overridden. This is probably what we want for location but for set-cookie this is bad. So says RFC 2109: " Informally, the Set-Cookie response header comprises the token Set- Cookie:, followed by a comma-separated list of one or more cookies. "
Issue status update for http://drupal.org/node/28629 Post a follow up: http://drupal.org/project/comments/add/28629 Project: Drupal Version: cvs Component: base system Category: bug reports Priority: critical Assigned to: chx Reported by: chx Updated by: Dries -Status: patch (ready to be committed) +Status: patch (code needs work) Please add a code comment quoting the relevant bits of the RFC. Like that, we'll be able to understand what is going on. Dries Previous comments: ------------------------------------------------------------------------ Wed, 10 Aug 2005 17:42:33 +0000 : chx Attachment: http://drupal.org/files/issues/resp.patch (775 bytes) This is an issue with cookies: when you get multiple response headers with the same name, they are overridden. This is probably what we want for location but for set-cookie this is bad. So says RFC 2109: " Informally, the Set-Cookie response header comprises the token Set- Cookie:, followed by a comma-separated list of one or more cookies. " ------------------------------------------------------------------------ Wed, 10 Aug 2005 18:05:04 +0000 : killes@www.drop.org according to the cited RFC I believe this to be correct. The patch does apply and does not cause parse errors. ;)
Issue status update for http://drupal.org/node/28629 Post a follow up: http://drupal.org/project/comments/add/28629 Project: Drupal Version: cvs Component: base system Category: bug reports Priority: critical Assigned to: chx Reported by: chx Updated by: chx -Status: patch (code needs work) +Status: patch (ready to be committed) Attachment: http://drupal.org/files/issues/set_cookie.patch (883 bytes) Well, now I feel this is ready to be commited. I even put a conditional in it, so only Set-Cookie header gets different treatment. chx Previous comments: ------------------------------------------------------------------------ Wed, 10 Aug 2005 17:42:33 +0000 : chx Attachment: http://drupal.org/files/issues/resp.patch (775 bytes) This is an issue with cookies: when you get multiple response headers with the same name, they are overridden. This is probably what we want for location but for set-cookie this is bad. So says RFC 2109: " Informally, the Set-Cookie response header comprises the token Set- Cookie:, followed by a comma-separated list of one or more cookies. " ------------------------------------------------------------------------ Wed, 10 Aug 2005 18:05:04 +0000 : killes@www.drop.org according to the cited RFC I believe this to be correct. The patch does apply and does not cause parse errors. ;) ------------------------------------------------------------------------ Thu, 11 Aug 2005 07:28:06 +0000 : Dries Please add a code comment quoting the relevant bits of the RFC. Like that, we'll be able to understand what is going on.
Issue status update for http://drupal.org/node/28629 Post a follow up: http://drupal.org/project/comments/add/28629 Project: Drupal Version: cvs Component: base system Category: bug reports Priority: critical Assigned to: chx Reported by: chx Updated by: Dries Status: patch (ready to be committed) Where did this bug trigger? One could argue that the $header-array (input parameter) is malformed and that it is the caller's problem. Dries Previous comments: ------------------------------------------------------------------------ Wed, 10 Aug 2005 17:42:33 +0000 : chx Attachment: http://drupal.org/files/issues/resp.patch (775 bytes) This is an issue with cookies: when you get multiple response headers with the same name, they are overridden. This is probably what we want for location but for set-cookie this is bad. So says RFC 2109: " Informally, the Set-Cookie response header comprises the token Set- Cookie:, followed by a comma-separated list of one or more cookies. " ------------------------------------------------------------------------ Wed, 10 Aug 2005 18:05:04 +0000 : killes@www.drop.org according to the cited RFC I believe this to be correct. The patch does apply and does not cause parse errors. ;) ------------------------------------------------------------------------ Thu, 11 Aug 2005 07:28:06 +0000 : Dries Please add a code comment quoting the relevant bits of the RFC. Like that, we'll be able to understand what is going on. ------------------------------------------------------------------------ Thu, 18 Aug 2005 05:13:14 +0000 : chx Attachment: http://drupal.org/files/issues/set_cookie.patch (883 bytes) Well, now I feel this is ready to be commited. I even put a conditional in it, so only Set-Cookie header gets different treatment.
Issue status update for http://drupal.org/node/28629 Post a follow up: http://drupal.org/project/comments/add/28629 Project: Drupal Version: cvs Component: base system Category: bug reports Priority: critical Assigned to: chx Reported by: chx Updated by: chx Status: patch (ready to be committed) The $header parameter is something you send out and what this patch affects are the result headers. This occurs if a site sets more than one cookie which is not unheard of. chx Previous comments: ------------------------------------------------------------------------ Wed, 10 Aug 2005 17:42:33 +0000 : chx Attachment: http://drupal.org/files/issues/resp.patch (775 bytes) This is an issue with cookies: when you get multiple response headers with the same name, they are overridden. This is probably what we want for location but for set-cookie this is bad. So says RFC 2109: " Informally, the Set-Cookie response header comprises the token Set- Cookie:, followed by a comma-separated list of one or more cookies. " ------------------------------------------------------------------------ Wed, 10 Aug 2005 18:05:04 +0000 : killes@www.drop.org according to the cited RFC I believe this to be correct. The patch does apply and does not cause parse errors. ;) ------------------------------------------------------------------------ Thu, 11 Aug 2005 07:28:06 +0000 : Dries Please add a code comment quoting the relevant bits of the RFC. Like that, we'll be able to understand what is going on. ------------------------------------------------------------------------ Thu, 18 Aug 2005 05:13:14 +0000 : chx Attachment: http://drupal.org/files/issues/set_cookie.patch (883 bytes) Well, now I feel this is ready to be commited. I even put a conditional in it, so only Set-Cookie header gets different treatment. ------------------------------------------------------------------------ Thu, 18 Aug 2005 21:43:53 +0000 : Dries Where did this bug trigger? One could argue that the $header-array (input parameter) is malformed and that it is the caller's problem.
Issue status update for http://drupal.org/node/28629 Post a follow up: http://drupal.org/project/comments/add/28629 Project: Drupal Version: cvs Component: base system Category: bug reports Priority: critical Assigned to: chx Reported by: chx Updated by: Dries Status: patch (ready to be committed) But _who_ calls drupal_http_request like that? Where is the culprit that triggered this bug? Dries Previous comments: ------------------------------------------------------------------------ Wed, 10 Aug 2005 17:42:33 +0000 : chx Attachment: http://drupal.org/files/issues/resp.patch (775 bytes) This is an issue with cookies: when you get multiple response headers with the same name, they are overridden. This is probably what we want for location but for set-cookie this is bad. So says RFC 2109: " Informally, the Set-Cookie response header comprises the token Set- Cookie:, followed by a comma-separated list of one or more cookies. " ------------------------------------------------------------------------ Wed, 10 Aug 2005 18:05:04 +0000 : killes@www.drop.org according to the cited RFC I believe this to be correct. The patch does apply and does not cause parse errors. ;) ------------------------------------------------------------------------ Thu, 11 Aug 2005 07:28:06 +0000 : Dries Please add a code comment quoting the relevant bits of the RFC. Like that, we'll be able to understand what is going on. ------------------------------------------------------------------------ Thu, 18 Aug 2005 05:13:14 +0000 : chx Attachment: http://drupal.org/files/issues/set_cookie.patch (883 bytes) Well, now I feel this is ready to be commited. I even put a conditional in it, so only Set-Cookie header gets different treatment. ------------------------------------------------------------------------ Thu, 18 Aug 2005 21:43:53 +0000 : Dries Where did this bug trigger? One could argue that the $header-array (input parameter) is malformed and that it is the caller's problem. ------------------------------------------------------------------------ Thu, 18 Aug 2005 23:02:52 +0000 : chx The $header parameter is something you send out and what this patch affects are the result headers. This occurs if a site sets more than one cookie which is not unheard of.
Issue status update for http://drupal.org/node/28629 Post a follow up: http://drupal.org/project/comments/add/28629 Project: Drupal Version: cvs Component: base system Category: bug reports Priority: critical Assigned to: chx Reported by: chx Updated by: chx Status: patch (ready to be committed) Try lynx http://www.paypal.com . You'll get: www.paypal.com cookie: sc_lucky_value=C8DF7645 Allow? (Y/N/Always/neVer) www.paypal.com cookie: cookie_check=yes Allow? (Y/N/Always/neVer) ww.paypal.com cookie: Apache=80.98.163.54.5329112474109433 Allow? (Y/N/Always/neVer) So, you need to take care of three Set-Cookie headers. If you take a look at the current code, only the last would be returned. chx Previous comments: ------------------------------------------------------------------------ Wed, 10 Aug 2005 17:42:33 +0000 : chx Attachment: http://drupal.org/files/issues/resp.patch (775 bytes) This is an issue with cookies: when you get multiple response headers with the same name, they are overridden. This is probably what we want for location but for set-cookie this is bad. So says RFC 2109: " Informally, the Set-Cookie response header comprises the token Set- Cookie:, followed by a comma-separated list of one or more cookies. " ------------------------------------------------------------------------ Wed, 10 Aug 2005 18:05:04 +0000 : killes@www.drop.org according to the cited RFC I believe this to be correct. The patch does apply and does not cause parse errors. ;) ------------------------------------------------------------------------ Thu, 11 Aug 2005 07:28:06 +0000 : Dries Please add a code comment quoting the relevant bits of the RFC. Like that, we'll be able to understand what is going on. ------------------------------------------------------------------------ Thu, 18 Aug 2005 05:13:14 +0000 : chx Attachment: http://drupal.org/files/issues/set_cookie.patch (883 bytes) Well, now I feel this is ready to be commited. I even put a conditional in it, so only Set-Cookie header gets different treatment. ------------------------------------------------------------------------ Thu, 18 Aug 2005 21:43:53 +0000 : Dries Where did this bug trigger? One could argue that the $header-array (input parameter) is malformed and that it is the caller's problem. ------------------------------------------------------------------------ Thu, 18 Aug 2005 23:02:52 +0000 : chx The $header parameter is something you send out and what this patch affects are the result headers. This occurs if a site sets more than one cookie which is not unheard of. ------------------------------------------------------------------------ Mon, 22 Aug 2005 19:34:04 +0000 : Dries But _who_ calls drupal_http_request like that? Where is the culprit that triggered this bug?
participants (3)
-
chx -
Dries
-
killes