unofficial mirror of emacs-devel@gnu.org 
 help / color / mirror / code / Atom feed
* Bug in url-retrieve-synchronously from url.el on redirect
@ 2020-07-10 18:18 Daniele Nicolodi
  2020-07-10 18:49 ` Yuri Khan
  0 siblings, 1 reply; 10+ messages in thread
From: Daniele Nicolodi @ 2020-07-10 18:18 UTC (permalink / raw)
  To: Emacs developers

[-- Attachment #1: Type: text/plain, Size: 1422 bytes --]

Hello,

url-retrieve-synchronously fails to obey redirect responses if the
returned "Location" header contains spaces: it redirects to the URL
truncated to the first space. It seems that spaces in the Location
header value are allowed (at least ngnix produces headers like that).

If I understand the code correctly, the redirect response in interpreted
in url-http-parse-headers where the header is explicitly truncated:

	 (when redirect-uri
	   ;; Clean off any whitespace and/or <...> cruft.
	   (if (string-match "\\([^ \t]+\\)[ \t]" redirect-uri)
	       (setq redirect-uri (match-string 1 redirect-uri)))
	   (if (string-match "^<\\(.*\\)>$" redirect-uri)
	       (setq redirect-uri (match-string 1 redirect-uri)))

I think the first regular expression is wrong. I believe that its intent
is to remove leading and trailing white space, but it actually truncates
the value to the first white space character. Also, redirect-uri is
obtained with

       (let ((redirect-uri (or (mail-fetch-field "Location")
			       (mail-fetch-field "URI"))))

and mail-fetch-field already removes leading and trailing whitespace.

I think the attached patch should fix the problem.

Finally, the removal of the < > delimiters seems unnecessary too as they
are not allowed delimiters in HTTP headers (in my reading of
https://tools.ietf.org/html/rfc7230) however there are no adverse
consequences in leaving it there.

Cheers,
Dan

[-- Attachment #2: 0001-url-http-Fix-handling-of-redirect-locations-containi.patch --]
[-- Type: text/plain, Size: 939 bytes --]

From f2408eaaa1e2afb6be15588e0f8f8a2c3cfe1ec6 Mon Sep 17 00:00:00 2001
From: Daniele Nicolodi <daniele@grinta.net>
Date: Fri, 10 Jul 2020 12:16:01 -0600
Subject: [PATCH] url-http: Fix handling of redirect locations containing
 whitespace

---
 lisp/url/url-http.el | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/lisp/url/url-http.el b/lisp/url/url-http.el
index 669c24571f..b7d6f42ed5 100644
--- a/lisp/url/url-http.el
+++ b/lisp/url/url-http.el
@@ -702,9 +702,7 @@ should be shown to the user."
 	    ;; Treat everything like '300'
 	    nil))
 	 (when redirect-uri
-	   ;; Clean off any whitespace and/or <...> cruft.
-	   (if (string-match "\\([^ \t]+\\)[ \t]" redirect-uri)
-	       (setq redirect-uri (match-string 1 redirect-uri)))
+	   ;; Clean off any <...> cruft.
 	   (if (string-match "^<\\(.*\\)>$" redirect-uri)
 	       (setq redirect-uri (match-string 1 redirect-uri)))
 
-- 
2.24.3 (Apple Git-128)


^ permalink raw reply related	[flat|nested] 10+ messages in thread

end of thread, other threads:[~2020-07-13 18:48 UTC | newest]

Thread overview: 10+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2020-07-10 18:18 Bug in url-retrieve-synchronously from url.el on redirect Daniele Nicolodi
2020-07-10 18:49 ` Yuri Khan
2020-07-10 19:37   ` Yuri Khan
2020-07-10 19:46     ` Daniele Nicolodi
2020-07-10 19:43   ` Daniele Nicolodi
2020-07-10 20:25     ` Yuri Khan
2020-07-10 20:32       ` Daniele Nicolodi
2020-07-11  0:55         ` Daniele Nicolodi
2020-07-13 18:15           ` chad
2020-07-13 18:48             ` Daniele Nicolodi

Code repositories for project(s) associated with this public inbox

	https://git.savannah.gnu.org/cgit/emacs.git

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).