bug#6957: url-cookie-expired-p

[shawn boles <shawn.boles@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 1051 bytes --]

Hello,

Please forgive me if this list is not the correct recipient for this
message. If there is a better destination, I will be happy to send it
on.

I am working on a web services client that is mostly a wrapper around
URL Package. I am using GNU Emacs v.23.2. My client implementation
requires keeping tight rein on a session ID cookie. My sessions are
terminating abnormally. I believe I have tracked this issue to a bug
in url-cookie-expired-p.

If the cookie's expiration date is the same as today's date,
url-cookie-expired-p normalizes the times to seconds and compares the
difference. I believe the problem is in the normalization algorithm.
In pseudo-code, the current implementation does:

(+ (* 360 seconds) (* 60 minutes) (* 1 hours))

I believe this should be:

(+ (* 1 seconds) (* 60 minutes) (* 360 hours)).

As is, the result of the comparison is almost always dependent on the
number of seconds in the time strings. It is interesting how
frequently this mistaken comparison is correct.

I have attached a patch.

Thank you,

-shawn

[-- Attachment #2: url-cookie.el.patch --]
[-- Type: application/octet-stream, Size: 1032 bytes --]

--- /cygdrive/c/src/Emacs/emacs-23.2/emacs-23.2/lisp/url/url-cookie.el	2010-08-31 10:53:08.860091900 -0700
+++ url-cookie.el	2010-08-31 12:33:41.970367100 -0700
@@ -215,12 +215,12 @@
      (t					; Expires sometime today, check times
       (let* ((cur-time (timezone-parse-time (aref cur-date 3)))
 	     (exp-time (timezone-parse-time (aref exp-date 3)))
-	     (cur-norm (+ (* 360 (string-to-number (aref cur-time 2)))
+	     (cur-norm (+ (* 360 (string-to-number (aref cur-time 0)))
 			  (*  60 (string-to-number (aref cur-time 1)))
-			  (*   1 (string-to-number (aref cur-time 0)))))
-	     (exp-norm (+ (* 360 (string-to-number (aref exp-time 2)))
+			  (*   1 (string-to-number (aref cur-time 2)))))
+	     (exp-norm (+ (* 360 (string-to-number (aref exp-time 0)))
 			  (*  60 (string-to-number (aref exp-time 1)))
-			  (*   1 (string-to-number (aref exp-time 0))))))
+			  (*   1 (string-to-number (aref exp-time 2))))))
 	(> (- cur-norm exp-norm) 1))))))
 
 (defun url-cookie-retrieve (host &optional localpart secure)