bug#16960: 24.3.50; Infinite loop in url-retrieve-synchronously if method is POST and response status is 301/302

bug#16960: 24.3.50; Infinite loop in url-retrieve-synchronously if method is POST and response status is 301/302

[Alex Kost]

[-- Attachment #1: Type: text/plain, Size: 798 bytes --]

The problem is the following: when I try to login to
https://aur.archlinux.org with `url-retrieve-synchronously' (see the
code below), Emacs freezes (C-g helps) because callback passed to
`url-retrieve' is never called.

AFAIU this happens because `url-http-parse-headers' returns nil if
response status is 301/302/307 and method is not "HEAD" or "GET" (see
<http://git.savannah.gnu.org/cgit/emacs.git/tree/lisp/url/url-http.el#n574>).
At least the problem goes away when I add:

  (setq success t)

after

  (or `moved-permanently `found `temporary-redirect)

in `url-http-parse-headers'.

Would it be OK to allow such requests?

Recipe is simple but you need to have an account on
<https://aur.archlinux.org> for that:

1. emacs -Q
2. Evaluate (setq url-debug t)
3. Evaluate the following code:


[-- Attachment #2: Type: application/emacs-lisp, Size: 892 bytes --]

[-- Attachment #3: Type: text/plain, Size: 346 bytes --]


3. Emacs hangs; press C-g
4. In "*URL-DEBUG*" buffer you can see the line:

  http -> Finished parsing HTTP headers: nil


In GNU Emacs 24.3.50.2 (i686-pc-linux-gnu, GTK+ Version 3.10.6)
 of 2014-02-02 on leviafan
Windowing system distributor `The X.Org Foundation', version 11.0.11500000
Configured using:
 `configure --prefix=/home/alexx/usr'

bug#16960: 24.3.50; Infinite loop in url-retrieve-synchronously if method is POST and response status is 301/302

[Lars Ingebrigtsen]

Alex Kost <alezost@gmail.com> writes:

> The problem is the following: when I try to login to
> https://aur.archlinux.org with `url-retrieve-synchronously' (see the
> code below), Emacs freezes (C-g helps) because callback passed to
> `url-retrieve' is never called.
>
> AFAIU this happens because `url-http-parse-headers' returns nil if
> response status is 301/302/307 and method is not "HEAD" or "GET" (see
> <http://git.savannah.gnu.org/cgit/emacs.git/tree/lisp/url/url-http.el#n574>).
> At least the problem goes away when I add:
>
>   (setq success t)
>
> after
>
>   (or `moved-permanently `found `temporary-redirect)
>
> in `url-http-parse-headers'.
>
> Would it be OK to allow such requests?
>
> Recipe is simple but you need to have an account on
> <https://aur.archlinux.org> for that:

I don't have an account there, so I can't reproduce this bug.  But could
you create a patch that fixes this problem?

-- 
(domestic pets only, the antidote for overdose, milk.)
   bloggy blog: http://lars.ingebrigtsen.no