Cookie Handling [rack/rack GH-8]

Cookie Handling [rack/rack GH-8]

[Christian Neukirchen]

mhat sent you a message.

--------------------
Rack appears to incorrectly handle cookies with values that are
quoted-strings. RFC2109 states that a value is a word and a may either
a token or a quoted-string. Rack is handling quoted-string values as
if they were tokens. Naturally this causes some problems.

It looks like the issue stems from the fact that Rack::Request#cookies
uses Rack::Utils.parse_query. What parse_query does makes sense for
parameters, but I think it is incorrect for cookie values.

If I have a cookie like so:
POST /acme/shipping HTTP/1.1
Cookie: $Version="1";
   Customer="WILE_E_COYOTE"; $Path="/acme";
   Part_Number="Rocket_Launcher_0001"; $Path="/acme"

The ruby String value for key Customer should be "WILE_E_COYOTE"
rather than "\"WILE_E_COYOTE\"".

You can imagine how this handling of quoted strings leads to
interoperability problems with other application stacks.

View this Issue online: http://github.com/rack/rack/issues#issue/8
--------------------

Re: Cookie Handling [rack/rack GH-8]

[Scytrin dai Kinthra]

[-- Attachment #1: Type: text/plain, Size: 1152 bytes --]

I can see about fixing this today if no one else is claiming it.
--
stadik.net

On Dec 2, 2009 5:14 AM, "Christian Neukirchen" <chneukirchen@gmail.com>
wrote:

mhat sent you a message.

--------------------
Rack appears to incorrectly handle cookies with values that are
quoted-strings. RFC2109 states that a value is a word and a may either
a token or a quoted-string. Rack is handling quoted-string values as
if they were tokens. Naturally this causes some problems.

It looks like the issue stems from the fact that Rack::Request#cookies
uses Rack::Utils.parse_query. What parse_query does makes sense for
parameters, but I think it is incorrect for cookie values.

If I have a cookie like so:
POST /acme/shipping HTTP/1.1
Cookie: $Version="1";
   Customer="WILE_E_COYOTE"; $Path="/acme";
   Part_Number="Rocket_Launcher_0001"; $Path="/acme"

The ruby String value for key Customer should be "WILE_E_COYOTE"
rather than "\"WILE_E_COYOTE\"".

You can imagine how this handling of quoted strings leads to
interoperability problems with other application stacks.

View this Issue online: http://github.com/rack/rack/issues#issue/8
--------------------

[-- Attachment #2: Type: text/html, Size: 1600 bytes --]

Re: Cookie Handling [rack/rack GH-8]

[Scytrin dai Kinthra]

[-- Attachment #1: Type: text/plain, Size: 405 bytes --]

Fixed, and pushed. Josh, you may want to add a few more tests or adjust the
code as you've done the latest tweaking on #parse_query

--
stadik.net

On Dec 2, 2009 9:19 AM, "Scytrin dai Kinthra" <scytrin@gmail.com> wrote:

I can see about fixing this today if no one else is claiming it.
--
stadik.net

> > On Dec 2, 2009 5:14 AM, "Christian Neukirchen" <chneukirchen@gmail.com>
wrote: > > mhat sent yo...

[-- Attachment #2: Type: text/html, Size: 762 bytes --]

Re: Cookie Handling [rack/rack GH-8]

[Joshua Peek]

Looks good.

On Thu, Dec 3, 2009 at 5:56 PM, Scytrin dai Kinthra <scytrin@gmail.com> wrote:
> Fixed, and pushed. Josh, you may want to add a few more tests or adjust the
> code as you've done the latest tweaking on #parse_query
>
> --
> stadik.net
>
> On Dec 2, 2009 9:19 AM, "Scytrin dai Kinthra" <scytrin@gmail.com> wrote:
>
> I can see about fixing this today if no one else is claiming it.
> --
> stadik.net
>
>> > On Dec 2, 2009 5:14 AM, "Christian Neukirchen" <chneukirchen@gmail.com>
>> > wrote: > > mhat sent yo...



-- 
Joshua Peek