You are viewing a plain text version of this content. The canonical link for it is here.
Posted to bugs@httpd.apache.org by bu...@apache.org on 2009/05/22 09:33:36 UTC
DO NOT REPLY [Bug 47241] New: Error in rewriting with character ':'
https://issues.apache.org/bugzilla/show_bug.cgi?id=47241
Summary: Error in rewriting with character ':'
Product: Apache httpd-2
Version: 2.2.11
Platform: PC
OS/Version: Linux
Status: NEW
Severity: minor
Priority: P2
Component: mod_rewrite
AssignedTo: bugs@httpd.apache.org
ReportedBy: bugzilla@schermesser.com
If you write a RewriteRule that set a cookie which contains a ':', the
mod_rewrite is interpreting the ':' as a separator character, but you have no
away to escape that character, and it is a valid character for a cookie value.
Eg if you set this RewriteRule :
RewriteRule ^/toto;jsessionid=(\w+):(\w+) -
[cookie=JSESSIONID:$1:$2:%{HTTP_HOST}]
You have no way to set the cookie name at "JSESSIONID" and it's value at
"$1:$2"
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 47241] Error in rewriting with character ':'
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=47241
--- Comment #5 from Eric Covener <co...@gmail.com> 2009-05-25 08:29:24 PST ---
Doesn't any value with a colon (or any other rfc2616 separator) need to be
quoted? IMO it would be better if rewrite short-circuited tokenizing based on
that, but I didn't test.
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 47241] Error in rewriting with character ':'
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=47241
Jonathan Clarke <jo...@phillipoux.net> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |wchao@yahoo.com
--- Comment #7 from Jonathan Clarke <jo...@phillipoux.net> 2009-06-07 23:58:12 PST ---
*** Bug 31781 has been marked as a duplicate of this bug. ***
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 47241] Error in rewriting with character ':'
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=47241
bugzilla@schermesser.com changed:
What |Removed |Added
----------------------------------------------------------------------------
Keywords| |PatchAvailable
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 47241] Error in rewriting with character ':'
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=47241
--- Comment #1 from bugzilla@schermesser.com 2009-05-22 00:36:57 PST ---
Created an attachment (id=23705)
--> (https://issues.apache.org/bugzilla/attachment.cgi?id=23705)
Patch File
Here is a patch that fixes the issue.
The idea of the patch is quite simple.
The character ';' is not allowed in a cookie (cf. RFC).
So if there is a ';' in the string of the cookie then the separator used is ';'
and not ':'.
But if there is no ';' in the string the default separator ':' is used. This is
to unsure backward compatibility.
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 47241] Error in rewriting with character ':'
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=47241
Anders Kaseorg <an...@kaseorg.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |anders@kaseorg.com
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 47241] Error in rewriting with character ':'
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=47241
--- Comment #4 from Jonathan Clarke <jo...@phillipoux.net> 2009-05-24 23:24:56 PST ---
Some additional info: using either the RewriteRule from the description or
comment #2, the rewrite log with RewriteLogLevel 9 is:
127.0.0.1 - - [25/May/2009:08:22:57 +0200]
[localhost/sid#b9d11ed8][rid#b9eac1a0/initial] (2) init rewrite engine with
requested uri /toto;jsessionid=abc:def
127.0.0.1 - - [25/May/2009:08:22:57 +0200]
[localhost/sid#b9d11ed8][rid#b9eac1a0/initial] (3) applying pattern
'^/toto;jsessionid=(\w+)(:)(\w+)' to uri '/toto;jsessionid=abc:def'
127.0.0.1 - - [25/May/2009:08:22:57 +0200]
[localhost/sid#b9d11ed8][rid#b9eac1a0/initial] (5) setting cookie
'JSESSIONID=abc; path=/; domain=def; expires=Mon, 25-May-2009 06:22:57 GMT'
127.0.0.1 - - [25/May/2009:08:22:57 +0200]
[localhost/sid#b9d11ed8][rid#b9eac1a0/initial] (1) pass through
/toto;jsessionid=abc:def
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 47241] Error in rewriting with character ':'
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=47241
--- Comment #8 from Jonathan Clarke <jo...@phillipoux.net> 2009-06-08 01:13:17 PST ---
Hi,
Just some details about separator characters to respond to Eric's comment.
RFC 2109 and the newer 2965 ("HTTP State Management Mechanism" aka Cookies)
states that within in the Set-Cookie, Set-Cookie2, Cookie and Cookie2 headers
the syntax is of attr=value pairs, separated by semi-colons (";") or commas
(",").
Any other special characters as defined in RFC 2616 are allowed in cookie
values, although they should presumably be "-quoted to respect RFC 2616. This
means that a colon (":") is a legal value in cookie attr=value pairs.
mod_rewrite strips all character escaping before reaching the set_cookie
function. Therefore, the set_cookie function can only work with non-escaped
text.
It seems to me to make sense to use semi-colon (";") as a separator for cookie
parts in mod_rewrite syntax, instead of colon (":"), since this is a separator
character anyway. The attached patch implements this proposition.
I hope this clarifies the problem and the proposed solution, and can be
considered for inclusion in Apache. Please let us know any comments on this.
Regards,
Jonathan
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 47241] Error in rewriting with character ':'
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=47241
Eric Covener <co...@gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |covener@gmail.com
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 47241] Error in rewriting with character ':'
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=47241
Jonathan Clarke <jo...@phillipoux.net> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |jonathan@phillipoux.net
--- Comment #3 from Jonathan Clarke <jo...@phillipoux.net> 2009-05-22 01:54:13 PST ---
I'm jumping in here, since I worked on this patch with the original reporter.
Using:
RewriteRule ^/toto;jsessionid=(\w+)(:)(\w+) -
[cookie=JSESSIONID:$1$2$3:%{HTTP_HOST}]
Produces exactly the same result as the rule in the bug description. This is
because all variables are replaced in the do_expand function, before getting to
add_cookie, which splits fields on the ":" character, and the input string
already has an extra ":".
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 47241] Error in rewriting with character ':'
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=47241
--- Comment #2 from Ruediger Pluem <rp...@apache.org> 2009-05-22 00:59:15 PST ---
How about
RewriteRule ^/toto;jsessionid=(\w+)(:)(\w+) -
[cookie=JSESSIONID:$1$2$3:%{HTTP_HOST}]
?
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 47241] Error in rewriting with character ':'
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=47241
Jonathan Clarke <jo...@phillipoux.net> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |ben.spencer@moody.edu
--- Comment #6 from Jonathan Clarke <jo...@phillipoux.net> 2009-06-07 23:56:42 PST ---
*** Bug 44647 has been marked as a duplicate of this bug. ***
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org