httpd-apreq-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Maurice Aubrey <maur...@hevanet.com>
Subject Re: patch to ignore blank cookie attributes
Date Tue, 18 Dec 2001 23:28:40 GMT
On Tue, Dec 18, 2001 at 07:27:01PM +0100, David N. Welton wrote:
> Joe Schaefer <joe+apache@sunstarsys.com> writes:
> 
> > Maurice Aubrey <maurice@hevanet.com> writes:
> > 
> > > --- c/apache_cookie.c.orig	Fri Dec  7 18:16:05 2001
> > > +++ c/apache_cookie.c	Fri Dec  7 18:16:32 2001
> > > @@ -188,7 +188,7 @@
> > >      *(char **)ap_push_array(arr) = (char *)val
> > >  
> > >  #define cookie_push_named(arr, name, val) \
> > > -    if(val) { \
> > > +    if(val && (strlen(val) > 0)) { \
> > >          cookie_push_arr(arr, ap_pstrcat(p, name, "=", val, NULL)); \
> > >      }
> > 
> > Thanks alot; I'm testing it now along with another patch that 
> > replaces line 177's ap_getword call with ap_getword_nulls;
> > that also seems to bring Apache::Cookie's behavior more in
> > step with CGI::Cookie. 
> > 
> > Will apply both patches RSN unless somebody objects.
> 
> Err, shoot, don't know if I've caught you in time, but it *should* be
> possible to send blank cookies, no?  I recall mod_dtcl users
> specifically requesting that they work.

It should still be possible to send blank cookies.  The patch
just prevents the domain, path, and expires attributes from being
included if they're blank.

I think this follows the RFC 2965 more closely as well.  It indicates:

  av-pairs    =     av-pair *(";" av-pair)
  av-pair     =     attr ["=" value]              ; optional value
  attr        =     token
  value       =     token | quoted-string

token is defined in RFC 2616, which says:

  token          = 1*<any CHAR except CTLs or separators>

So the old behavior would violate the av-pair rule when you set blank
attributes.  Another option would be to insert an empty quoted string
in this case, but I don't know if that would really be useful, or even
be compatible with the original Netscape implementation.

Maurice

Mime
View raw message