From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!.POSTED!not-for-mail From: Lars Ingebrigtsen Newsgroups: gmane.emacs.bugs Subject: bug#24757: 25.1.50; url-cookie.el creates phantom cookie for HttpOnly Date: Sun, 15 Apr 2018 21:47:35 +0200 Message-ID: <874lkc6ylk.fsf@mouse.gnus.org> References: <8637jp64ow.fsf@realize.ch> NNTP-Posting-Host: blaine.gmane.org Mime-Version: 1.0 Content-Type: text/plain X-Trace: blaine.gmane.org 1523821567 12558 195.159.176.226 (15 Apr 2018 19:46:07 GMT) X-Complaints-To: usenet@blaine.gmane.org NNTP-Posting-Date: Sun, 15 Apr 2018 19:46:07 +0000 (UTC) User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.0.50 (gnu/linux) Cc: 24757@debbugs.gnu.org To: Alain Schneble Original-X-From: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Sun Apr 15 21:46:02 2018 Return-path: Envelope-to: geb-bug-gnu-emacs@m.gmane.org Original-Received: from lists.gnu.org ([208.118.235.17]) by blaine.gmane.org with esmtp (Exim 4.84_2) (envelope-from ) id 1f7nb8-0003C8-AD for geb-bug-gnu-emacs@m.gmane.org; Sun, 15 Apr 2018 21:46:02 +0200 Original-Received: from localhost ([::1]:38489 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1f7ndE-0003BZ-T6 for geb-bug-gnu-emacs@m.gmane.org; Sun, 15 Apr 2018 15:48:12 -0400 Original-Received: from eggs.gnu.org ([2001:4830:134:3::10]:50955) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1f7nd8-0003BD-3f for bug-gnu-emacs@gnu.org; Sun, 15 Apr 2018 15:48:07 -0400 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1f7nd4-0006Zc-5D for bug-gnu-emacs@gnu.org; Sun, 15 Apr 2018 15:48:06 -0400 Original-Received: from debbugs.gnu.org ([208.118.235.43]:46652) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1f7nd4-0006ZW-18 for bug-gnu-emacs@gnu.org; Sun, 15 Apr 2018 15:48:02 -0400 Original-Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1f7nd3-0000eW-NU for bug-gnu-emacs@gnu.org; Sun, 15 Apr 2018 15:48:01 -0400 X-Loop: help-debbugs@gnu.org Resent-From: Lars Ingebrigtsen Original-Sender: "Debbugs-submit" Resent-CC: bug-gnu-emacs@gnu.org Resent-Date: Sun, 15 Apr 2018 19:48:01 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 24757 X-GNU-PR-Package: emacs X-GNU-PR-Keywords: patch Original-Received: via spool by 24757-submit@debbugs.gnu.org id=B24757.15238216672483 (code B ref 24757); Sun, 15 Apr 2018 19:48:01 +0000 Original-Received: (at 24757) by debbugs.gnu.org; 15 Apr 2018 19:47:47 +0000 Original-Received: from localhost ([127.0.0.1]:54549 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1f7ncp-0000dy-2d for submit@debbugs.gnu.org; Sun, 15 Apr 2018 15:47:47 -0400 Original-Received: from hermes.netfonds.no ([80.91.224.195]:38766) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1f7ncn-0000dq-4G for 24757@debbugs.gnu.org; Sun, 15 Apr 2018 15:47:45 -0400 Original-Received: from 46.67.12.60.tmi.telenormobil.no ([46.67.12.60] helo=corrigan) by hermes.netfonds.no with esmtpsa (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.84_2) (envelope-from ) id 1f7ncj-0002KI-KX; Sun, 15 Apr 2018 21:47:44 +0200 Original-Received: from larsi by corrigan with local (Exim 4.89) (envelope-from ) id 1f7ncd-00051G-NA; Sun, 15 Apr 2018 21:47:35 +0200 In-Reply-To: <8637jp64ow.fsf@realize.ch> (Alain Schneble's message of "Fri, 21 Oct 2016 18:35:11 +0200") X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 208.118.235.43 X-BeenThere: bug-gnu-emacs@gnu.org List-Id: "Bug reports for GNU Emacs, the Swiss army knife of text editors" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Original-Sender: "bug-gnu-emacs" Xref: news.gmane.org gmane.emacs.bugs:145406 Archived-At: Alain Schneble writes: > Processing an HTTP response with a Set-Cookie header and HttpOnly > attribute creates a phantom cookie with name HttpOnly. url-cookie.el > (url-cookie-handle-set-cookie) handles the additional HttpOnly attribute > as the name of an additional cookie, thus interpreting Set-Cookie header > value as it would contain multiple cookies. This is wrong. See also > RFC6265 HTTP State Management Mechanism, section 4.1.2.6: > https://www.rfc-editor.org/rfc/rfc6265.txt. > > Here's a recipe to reproduce this issue: > > - emacs -Q > - Eval the following fragment: > (let ((file (make-temp-file "CookieHttpOnly"))) > (with-temp-buffer > (insert > "(setq url-cookie-storage nil)\n" > "(setq url-cookie-secure-storage nil)") > (write-file file)) > (setq url-cookie-file file) > (url-retrieve-synchronously "https://en.wikipedia.org/wiki/GNU_Guile") > (url-cookie-write-file) > (find-file file)) > - The visited cookies file should now contain two cookie entries: > ("en.wikipedia.org" > [url-cookie "WMF-Last-Access" "21-Oct-2016" "Tue, 22 Nov 2016 12:00:00 GMT" "/" "en.wikipedia.org" t] > [url-cookie "HttpOnly" nil "Tue, 22 Nov 2016 12:00:00 GMT" "/" "en.wikipedia.org" t]) > => The second cookie entry is not expected. I'm unable to reproduce this now, and I seem to vaguely remember this being fixed a while ago? Are you still seeing this, Alan? -- (domestic pets only, the antidote for overdose, milk.) bloggy blog: http://lars.ingebrigtsen.no