From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!.POSTED!not-for-mail From: Eli Zaretskii Newsgroups: gmane.emacs.devel Subject: Re: [PATCH] url: Wrap cookie headers in url-http--encode-string. Date: Fri, 09 Sep 2016 10:57:09 +0300 Message-ID: <83bmzx8q0a.fsf@gnu.org> References: <20160907153014.15752-1-toke@toke.dk> <87inu7k5z4.fsf@toke.dk> <83bmzzaawr.fsf@gnu.org> <877fank1oc.fsf@toke.dk> <87inu6iim8.fsf@toke.dk> <2563921f-d20d-753b-09eb-c8671bc5b6d6@yandex.ru> <87a8fiidso.fsf@toke.dk> <83oa3y8g0x.fsf@gnu.org> <83k2em8dzs.fsf@gnu.org> <86wpimqgn8.fsf@realize.ch> Reply-To: Eli Zaretskii NNTP-Posting-Host: blaine.gmane.org X-Trace: blaine.gmane.org 1473407861 30605 195.159.176.226 (9 Sep 2016 07:57:41 GMT) X-Complaints-To: usenet@blaine.gmane.org NNTP-Posting-Date: Fri, 9 Sep 2016 07:57:41 +0000 (UTC) Cc: toke@toke.dk, emacs-devel@gnu.org, monnier@IRO.UMontreal.CA, dgutov@yandex.ru To: Alain Schneble Original-X-From: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Fri Sep 09 09:57:36 2016 Return-path: Envelope-to: ged-emacs-devel@m.gmane.org Original-Received: from lists.gnu.org ([208.118.235.17]) by blaine.gmane.org with esmtp (Exim 4.84_2) (envelope-from ) id 1biGgm-0006tk-1t for ged-emacs-devel@m.gmane.org; Fri, 09 Sep 2016 09:57:32 +0200 Original-Received: from localhost ([::1]:56432 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1biGgk-0000BV-43 for ged-emacs-devel@m.gmane.org; Fri, 09 Sep 2016 03:57:30 -0400 Original-Received: from eggs.gnu.org ([2001:4830:134:3::10]:48074) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1biGgd-0000BL-Mu for emacs-devel@gnu.org; Fri, 09 Sep 2016 03:57:24 -0400 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1biGgZ-0005pE-4l for emacs-devel@gnu.org; Fri, 09 Sep 2016 03:57:22 -0400 Original-Received: from fencepost.gnu.org ([2001:4830:134:3::e]:41818) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1biGgZ-0005p8-1w; Fri, 09 Sep 2016 03:57:19 -0400 Original-Received: from 84.94.185.246.cable.012.net.il ([84.94.185.246]:4616 helo=home-c4e4a596f7) by fencepost.gnu.org with esmtpsa (TLS1.2:RSA_AES_128_CBC_SHA1:128) (Exim 4.82) (envelope-from ) id 1biGgX-000577-Tp; Fri, 09 Sep 2016 03:57:18 -0400 In-reply-to: <86wpimqgn8.fsf@realize.ch> (message from Alain Schneble on Thu, 8 Sep 2016 22:29:47 +0200) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 2001:4830:134:3::e X-BeenThere: emacs-devel@gnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: "Emacs development discussions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Original-Sender: "Emacs-devel" Xref: news.gmane.org gmane.emacs.devel:207305 Archived-At: > From: Alain Schneble > CC: Stefan Monnier , , > , > Date: Thu, 8 Sep 2016 22:29:47 +0200 > > FWIW, Mozilla refers to RFC6265 > https://tools.ietf.org/html/rfc6265#section-5.4: > > Bottom of Page 26 says: > > NOTE: Despite its name, the cookie-string is actually a sequence of > octets, not a sequence of characters. To convert the cookie-string > (or components thereof) into a sequence of characters (e.g., for > presentation to the user), the user agent might wish to try using the > UTF-8 character encoding [RFC3629] to decode the octet sequence. > This decoding might fail, however, because not every sequence of > octets is valid UTF-8. > > See also > https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cookie. If the cookies file can include non-ASCII characters, then IMO Stefan is right, and url-cookie-generate-header should produce a unibyte string consisting of UTF-8 sequences. However, I think for the emacs-25 branch, it would be safer to encode the cookie header explicitly in url-http-create-request; we could make the change in url-cookie-generate-header on master. Any objections? P.S. We should decide about the change on emacs-25 quickly, because the current plan calls for the final 25.1 release tarball on Sep 12. Thanks.