Re: [PATCH] gnu: Add erlang.

Re: [PATCH] gnu: Add erlang.

[Andy Wingo]

On Mon 04 Jan 2016 06:20, Steve Sprang <steve.sprang@gmail.com> writes:

> From http://www.erlang.org/download/otp_src_18.2.1.tar.gz...
> ERROR: Bad qstring header component: kMSMAn68110840

This means the server is emitting bad HTTP.  If I connect with:

   GET /download/otp_src_18.2.1.tar.gz HTTP/1.1
   Host: www.erlang.org
   Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
   User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/601.1 (KHTML, like Gecko) Version/8.0 Safari/601.1 Epiphany/3.16.3
   Accept-Encoding: gzip, deflate
   Accept-Language: en
   Connection: Keep-Alive

The server responds with:

   HTTP/1.1 200 OK
   Server: inets/5.7.1
   Date: Mon, 04 Jan 2016 11:32:30 GMT
   Content-Type: text/plain;  charset=utf-8
   Etag: kMSMAn68110840
   Content-Length: 68110840
   Last-Modified: Fri, 18 Dec 2015 11:00:38 GMT
   Connection:close

   ...

The Etag value is invalid:

  https://tools.ietf.org/html/rfc7232#section-2.3

We could relax Guile's etag parser to assume that an etag not starting
with either W/ or " is a strong etag without quotes.  To do that you
would patch guile's http.scm to say:

(define (parse-entity-tag val)
  (cond
   ((string-prefix? "W/" val) (cons (parse-qstring val 2) #f))
   ((string-prefix? "\"" val) (cons (parse-qstring val) #t))
   (else (cons val #t))))

Considering that this error has come up a few times and that the less
strict parser doesn't change the Guile programming interface or endanger
the web in any significant way, I think changing Guile's HTTP parser
would be OK.

Thoughts?

Andy

Re: [PATCH] gnu: Add erlang.

[Nala Ginrut]

Someone had reported the similar problem to Artanis:
https://github.com/NalaGinrut/artanis/issues/44

It's because some client (firefox, in this case) emits wrong header. But
nowadays many clients seems break RFC. Maybe make the parsing rule
little looser is better. 
And maybe add a warning? But seems useless to change anything.
So I agree with you to change our http parser. 

Best regards.

On Mon, 2016-01-04 at 12:44 +0100, Andy Wingo wrote:
> On Mon 04 Jan 2016 06:20, Steve Sprang <steve.sprang@gmail.com> writes:
> 
> > From http://www.erlang.org/download/otp_src_18.2.1.tar.gz...
> > ERROR: Bad qstring header component: kMSMAn68110840
> 
> This means the server is emitting bad HTTP.  If I connect with:
> 
>    GET /download/otp_src_18.2.1.tar.gz HTTP/1.1
>    Host: www.erlang.org
>    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
>    User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/601.1 (KHTML, like Gecko) Version/8.0 Safari/601.1 Epiphany/3.16.3
>    Accept-Encoding: gzip, deflate
>    Accept-Language: en
>    Connection: Keep-Alive
> 
> The server responds with:
> 
>    HTTP/1.1 200 OK
>    Server: inets/5.7.1
>    Date: Mon, 04 Jan 2016 11:32:30 GMT
>    Content-Type: text/plain;  charset=utf-8
>    Etag: kMSMAn68110840
>    Content-Length: 68110840
>    Last-Modified: Fri, 18 Dec 2015 11:00:38 GMT
>    Connection:close
> 
>    ...
> 
> The Etag value is invalid:
> 
>   https://tools.ietf.org/html/rfc7232#section-2.3
> 
> We could relax Guile's etag parser to assume that an etag not starting
> with either W/ or " is a strong etag without quotes.  To do that you
> would patch guile's http.scm to say:
> 
> (define (parse-entity-tag val)
>   (cond
>    ((string-prefix? "W/" val) (cons (parse-qstring val 2) #f))
>    ((string-prefix? "\"" val) (cons (parse-qstring val) #t))
>    (else (cons val #t))))
> 
> Considering that this error has come up a few times and that the less
> strict parser doesn't change the Guile programming interface or endanger
> the web in any significant way, I think changing Guile's HTTP parser
> would be OK.
> 
> Thoughts?
> 
> Andy
> 

Re: [PATCH] gnu: Add erlang.

[tomas]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> > On Mon 04 Jan 2016 06:20, Steve Sprang <steve.sprang@gmail.com> writes:
> > 
> > > From http://www.erlang.org/download/otp_src_18.2.1.tar.gz...
> > > ERROR: Bad qstring header component: kMSMAn68110840
[...]

[Andy Wingo]
> > The Etag value is invalid:
> > 
> >   https://tools.ietf.org/html/rfc7232#section-2.3
> > 
> > We could relax Guile's etag parser to assume that an etag not starting
> > with either W/ or " is a strong etag without quotes.  To do that you
> > would patch guile's http.scm to say:

On Mon, Jan 04, 2016 at 08:13:25PM +0800, Nala Ginrut wrote:
> Someone had reported the similar problem to Artanis:
> https://github.com/NalaGinrut/artanis/issues/44
> 
> It's because some client (firefox, in this case) emits wrong header [...]

Thirded. It doesn't make sense to be too strict on the InterWebs.

And we can invoke Postel's Law [1] on that, RFCs and all :-)

[1] <https://en.wikipedia.org/wiki/Robustness_principle>

thanks
- -- tomás
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlaKX3sACgkQBcgs9XrR2kbMPACffyBhOkhaR2sKnn1/LzhyjPzp
sDEAnRCyJMUUXDULBQ8Yv1mpYrUNDVB1
=zjKF
-----END PGP SIGNATURE-----

Re: [PATCH] gnu: Add erlang.

[Ludovic Courtès]

On Mon 04 Jan 2016 06:20, Steve Sprang <steve.sprang@gmail.com> writes:

> From http://www.erlang.org/download/otp_src_18.2.1.tar.gz...
> ERROR: Bad qstring header component: kMSMAn68110840

Andy Wingo <wingo@igalia.com> skribis:

> The Etag value is invalid:
>
>   https://tools.ietf.org/html/rfc7232#section-2.3
>
> We could relax Guile's etag parser to assume that an etag not starting
> with either W/ or " is a strong etag without quotes.  To do that you
> would patch guile's http.scm to say:
>
> (define (parse-entity-tag val)
>   (cond
>    ((string-prefix? "W/" val) (cons (parse-qstring val 2) #f))
>    ((string-prefix? "\"" val) (cons (parse-qstring val) #t))
>    (else (cons val #t))))
>
> Considering that this error has come up a few times and that the less
> strict parser doesn't change the Guile programming interface or endanger
> the web in any significant way, I think changing Guile's HTTP parser
> would be OK.
>
> Thoughts?

Indeed, this has been reported a few times:

  http://bugs.gnu.org/19439

I think we should implement the proposed change.  Could you look
into it?

Thanks,
Ludo’.

Re: [PATCH] gnu: Add erlang.

[Andy Wingo]

On Wed 06 Jan 2016 17:07, ludo@gnu.org (Ludovic Courtès) writes:

> On Mon 04 Jan 2016 06:20, Steve Sprang <steve.sprang@gmail.com> writes:
>
>> From http://www.erlang.org/download/otp_src_18.2.1.tar.gz...
>> ERROR: Bad qstring header component: kMSMAn68110840
>
> I think we should implement the proposed change.  Could you look
> into it?

Done on master in 6d7c09c8a9900794a855b9c69c57c3d1736506ed.  I'd
cherry-pick back to 2.0 but I don't have a checkout on this machine;
please feel free :)

Cheers,

Andy

Re: [PATCH] gnu: Add erlang.

[tomas]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Thu, Jan 07, 2016 at 10:56:29AM +0100, Andy Wingo wrote:
> On Wed 06 Jan 2016 17:07, ludo@gnu.org (Ludovic Courtès) writes:
> 
> > On Mon 04 Jan 2016 06:20, Steve Sprang <steve.sprang@gmail.com> writes:
> >
> >> From http://www.erlang.org/download/otp_src_18.2.1.tar.gz...
> >> ERROR: Bad qstring header component: kMSMAn68110840
> >
> > I think we should implement the proposed change.  Could you look
> > into it?
> 
> Done on master in 6d7c09c8a9900794a855b9c69c57c3d1736506ed [...]

Wohoo! -- uh, thanks :-)
- -- t
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlaOOCUACgkQBcgs9XrR2kaSswCggHgqMjJoMQ7vZAXBQA+p8wRp
9Q8AniMxjZ8EwSVXVUJ9uOgg7dkSmWPE
=EJw6
-----END PGP SIGNATURE-----

bug#19439: [PATCH] gnu: Add erlang.

[Andy Wingo]

Backported to 2.0 in c5dac3595f42afbd76ab9110d7473bf4d16b0520 by
Ludovic; closing bug.

On Thu 07 Jan 2016 10:56, Andy Wingo <wingo@igalia.com> writes:

> On Wed 06 Jan 2016 17:07, ludo@gnu.org (Ludovic Courtès) writes:
>
>> On Mon 04 Jan 2016 06:20, Steve Sprang <steve.sprang@gmail.com> writes:
>>
>>> From http://www.erlang.org/download/otp_src_18.2.1.tar.gz...
>>> ERROR: Bad qstring header component: kMSMAn68110840
>>
>> I think we should implement the proposed change.  Could you look
>> into it?
>
> Done on master in 6d7c09c8a9900794a855b9c69c57c3d1736506ed.  I'd
> cherry-pick back to 2.0 but I don't have a checkout on this machine;
> please feel free :)
>
> Cheers,
>
> Andy