You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by ma...@apache.org on 2024/03/15 18:49:40 UTC
(tomcat) branch main updated (0fc30f2434 -> d16e846c45)
This is an automated email from the ASF dual-hosted git repository.
markt pushed a change to branch main
in repository https://gitbox.apache.org/repos/asf/tomcat.git
from 0fc30f2434 Add ignores for vi swap files.
new 3e1113dcf7 Correct section title
new 8b766b3ce2 Output cookie attributes with the value "" as bare attribute names
new 4ca2a66d62 Refactor the internal representation of the HttpOnly and Secure
new d16e846c45 Don't use Max-Age=0 in Set-Cookie headers
The 4 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
java/jakarta/servlet/http/Cookie.java | 10 +++---
.../tomcat/util/http/Rfc6265CookieProcessor.java | 36 ++++++++++++----------
.../util/http/TestCookieProcessorGeneration.java | 13 ++++++--
webapps/docs/changelog.xml | 21 ++++++++++++-
4 files changed, 57 insertions(+), 23 deletions(-)
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
(tomcat) 04/04: Don't use Max-Age=0 in Set-Cookie headers
Posted by ma...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
markt pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit d16e846c4538ea9d4904cd2d74db41f0a7bcf3a6
Author: Mark Thomas <ma...@apache.org>
AuthorDate: Fri Mar 15 17:18:31 2024 +0000
Don't use Max-Age=0 in Set-Cookie headers
---
.../tomcat/util/http/Rfc6265CookieProcessor.java | 26 +++++++++++-----------
.../util/http/TestCookieProcessorGeneration.java | 13 +++++++++--
webapps/docs/changelog.xml | 6 +++++
3 files changed, 30 insertions(+), 15 deletions(-)
diff --git a/java/org/apache/tomcat/util/http/Rfc6265CookieProcessor.java b/java/org/apache/tomcat/util/http/Rfc6265CookieProcessor.java
index acdec29e78..e8227a6d0d 100644
--- a/java/org/apache/tomcat/util/http/Rfc6265CookieProcessor.java
+++ b/java/org/apache/tomcat/util/http/Rfc6265CookieProcessor.java
@@ -121,28 +121,28 @@ public class Rfc6265CookieProcessor extends CookieProcessorBase {
header.append(value);
}
- // RFC 6265 prefers Max-Age to Expires but... (see below)
+ /*
+ * RFC 6265 prefers Max-Age to Expires but some browsers including Microsoft IE and Microsoft Edge don't
+ * understand Max-Age so send expires as well. Without this, persistent cookies fail with those browsers.
+ */
int maxAge = cookie.getMaxAge();
- if (maxAge > -1) {
- // Negative Max-Age is equivalent to no Max-Age
- header.append("; Max-Age=");
- header.append(maxAge);
-
- // Microsoft IE and Microsoft Edge don't understand Max-Age so send
- // expires as well. Without this, persistent cookies fail with those
- // browsers. See http://tomcat.markmail.org/thread/g6sipbofsjossacn
- // Wdy, DD-Mon-YY HH:MM:SS GMT ( Expires Netscape format )
+ // Negative Max-Age is equivalent to no Max-Age
+ if (maxAge > -1) {
header.append("; Expires=");
- // To expire immediately we need to set the time in past
if (maxAge == 0) {
+ // To expire immediately we need to set the time in past
header.append(ANCIENT_DATE);
} else {
- COOKIE_DATE_FORMAT.get().format(new Date(System.currentTimeMillis() + maxAge * 1000L), header,
- new FieldPosition(0));
+ COOKIE_DATE_FORMAT.get().format(
+ new Date(System.currentTimeMillis() + maxAge * 1000L), header, new FieldPosition(0));
+
+ header.append("; Max-Age=");
+ header.append(maxAge);
}
}
+
String domain = cookie.getDomain();
if (domain != null && domain.length() > 0) {
validateDomain(domain);
diff --git a/test/org/apache/tomcat/util/http/TestCookieProcessorGeneration.java b/test/org/apache/tomcat/util/http/TestCookieProcessorGeneration.java
index 3079f423f8..e56a5aa675 100644
--- a/test/org/apache/tomcat/util/http/TestCookieProcessorGeneration.java
+++ b/test/org/apache/tomcat/util/http/TestCookieProcessorGeneration.java
@@ -110,7 +110,7 @@ public class TestCookieProcessorGeneration {
@Test
public void testMaxAgeZero() {
- doTestMaxAge(0, "foo=bar; Max-Age=0; Expires=Thu, 01 Jan 1970 00:00:10 GMT");
+ doTestMaxAge(0, "foo=bar; Expires=Thu, 01 Jan 1970 00:00:10 GMT");
}
@Test
@@ -267,7 +267,16 @@ public class TestCookieProcessorGeneration {
cookie.getMaxAge() > 0) {
// Expires attribute will depend on time cookie is generated so
// use a modified test
- Assert.assertTrue(cookieProcessor.generateHeader(cookie, null).startsWith(expected));
+ String result = cookieProcessor.generateHeader(cookie, null);
+ int posExpiresStart = result.indexOf("Expires");
+ if (posExpiresStart > -1) {
+ int posExpiresEnd = result.indexOf(';', posExpiresStart);
+ if (posExpiresEnd > -1) {
+ // Expires was not at the end of the header - remove it
+ result = result.substring(0, posExpiresStart -1) + result.substring(posExpiresEnd + 1);
+ }
+ }
+ Assert.assertTrue(result.startsWith(expected));
} else {
Assert.assertEquals(expected, cookieProcessor.generateHeader(cookie, null));
}
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index d8b9343f15..981ae76a04 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -141,6 +141,12 @@
consistency with the recent changes to <code>Set-Cookie</code> header
generation. (markt)
</scode>
+ <fix>
+ Do not generate the <code>Max-Age</code> attribute for
+ <code>Set-Cookie</code> headers associated with cookies that have been
+ configured with a <code>Max-Age</code> value of zero as RFC 6265 does
+ not permit a value of zero in this case. (markt)
+ </fix>
</changelog>
</subsection>
<subsection name="Jasper">
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
(tomcat) 03/04: Refactor the internal representation of the HttpOnly and Secure
Posted by ma...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
markt pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit 4ca2a66d6203ce7843fbaa9fd47be82cba477781
Author: Mark Thomas <ma...@apache.org>
AuthorDate: Fri Mar 15 17:15:03 2024 +0000
Refactor the internal representation of the HttpOnly and Secure
Use the empty string as the value
This is for consistency with the recent changes to Set-Cookie header
generation
---
java/jakarta/servlet/http/Cookie.java | 10 ++++++----
webapps/docs/changelog.xml | 6 ++++++
2 files changed, 12 insertions(+), 4 deletions(-)
diff --git a/java/jakarta/servlet/http/Cookie.java b/java/jakarta/servlet/http/Cookie.java
index 22ddc5d3ff..5c52a59d47 100644
--- a/java/jakarta/servlet/http/Cookie.java
+++ b/java/jakarta/servlet/http/Cookie.java
@@ -54,6 +54,8 @@ public class Cookie implements Cloneable, Serializable {
private static final CookieNameValidator validation = new RFC6265Validator();
+ private static final String EMPTY_STRING = "";
+
private static final long serialVersionUID = 2L;
/**
@@ -238,7 +240,7 @@ public class Cookie implements Cloneable, Serializable {
* @see #getSecure
*/
public void setSecure(boolean flag) {
- setAttributeInternal(SECURE, Boolean.toString(flag));
+ setAttributeInternal(SECURE, EMPTY_STRING);
}
@@ -251,7 +253,7 @@ public class Cookie implements Cloneable, Serializable {
* @see #setSecure
*/
public boolean getSecure() {
- return Boolean.parseBoolean(getAttribute(SECURE));
+ return EMPTY_STRING.equals(getAttribute(SECURE));
}
@@ -347,7 +349,7 @@ public class Cookie implements Cloneable, Serializable {
* @since Servlet 3.0
*/
public void setHttpOnly(boolean httpOnly) {
- setAttributeInternal(HTTP_ONLY, Boolean.toString(httpOnly));
+ setAttributeInternal(HTTP_ONLY, EMPTY_STRING);
}
@@ -359,7 +361,7 @@ public class Cookie implements Cloneable, Serializable {
* @since Servlet 3.0
*/
public boolean isHttpOnly() {
- return Boolean.parseBoolean(getAttribute(HTTP_ONLY));
+ return EMPTY_STRING.equals(getAttribute(HTTP_ONLY));
}
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index 042b5376d7..d8b9343f15 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -135,6 +135,12 @@
equals sign or value. This will simplify future support for similar new
attributes by removing the need for special handling. (markt)
</update>
+ <scode>
+ Refactor the internal representation of the <code>HttpOnly</code> and
+ <code>Secure</code> attributes to use the empty string as the value for
+ consistency with the recent changes to <code>Set-Cookie</code> header
+ generation. (markt)
+ </scode>
</changelog>
</subsection>
<subsection name="Jasper">
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
(tomcat) 02/04: Output cookie attributes with the value "" as bare attribute names
Posted by ma...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
markt pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit 8b766b3ce2d3942a1a3027a8902df010eb9589d5
Author: Mark Thomas <ma...@apache.org>
AuthorDate: Fri Mar 15 17:12:20 2024 +0000
Output cookie attributes with the value "" as bare attribute names
e.g. ...; Partitioned; Secure; HttpOnly; SomeNewAttribute;...
This will simplify future support for similar new attributes by removing
the need for special handling.
---
java/org/apache/tomcat/util/http/Rfc6265CookieProcessor.java | 10 +++++++---
webapps/docs/changelog.xml | 7 +++++++
2 files changed, 14 insertions(+), 3 deletions(-)
diff --git a/java/org/apache/tomcat/util/http/Rfc6265CookieProcessor.java b/java/org/apache/tomcat/util/http/Rfc6265CookieProcessor.java
index 05a712ecb5..acdec29e78 100644
--- a/java/org/apache/tomcat/util/http/Rfc6265CookieProcessor.java
+++ b/java/org/apache/tomcat/util/http/Rfc6265CookieProcessor.java
@@ -41,6 +41,8 @@ public class Rfc6265CookieProcessor extends CookieProcessorBase {
private static final StringManager sm =
StringManager.getManager(Rfc6265CookieProcessor.class.getPackage().getName());
+ private static final String EMPTY_STRING = "";
+
private static final BitSet domainValid = new BitSet(128);
static {
@@ -183,7 +185,7 @@ public class Rfc6265CookieProcessor extends CookieProcessorBase {
header.append("; Partitioned");
}
} else {
- if (Boolean.parseBoolean(cookiePartitioned)) {
+ if (EMPTY_STRING.equals(cookiePartitioned)) {
header.append("; Partitioned");
}
}
@@ -206,8 +208,10 @@ public class Rfc6265CookieProcessor extends CookieProcessorBase {
validateAttribute(entry.getKey(), entry.getValue());
header.append("; ");
header.append(entry.getKey());
- header.append('=');
- header.append(entry.getValue());
+ if (!EMPTY_STRING.equals(entry.getValue())) {
+ header.append('=');
+ header.append(entry.getValue());
+ }
}
}
}
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index 1f7c2bf776..042b5376d7 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -128,6 +128,13 @@
will scale back to the configured <code>minSpareThreads</code> size.
(remm)
</fix>
+ <update>
+ Adjust the <code>Set-Cookie</code> header generated by the
+ <code>Rfc6265CookieProcessor</code> so that attributes with a value of
+ the empty string will be output as bare attribute names without an
+ equals sign or value. This will simplify future support for similar new
+ attributes by removing the need for special handling. (markt)
+ </update>
</changelog>
</subsection>
<subsection name="Jasper">
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: (tomcat) 01/04: Correct section title
Posted by Rémy Maucherat <re...@apache.org>.
On Fri, Mar 15, 2024 at 7:50 PM <ma...@apache.org> wrote:
>
> This is an automated email from the ASF dual-hosted git repository.
>
> markt pushed a commit to branch main
> in repository https://gitbox.apache.org/repos/asf/tomcat.git
>
> commit 3e1113dcf764f90bf1720c752667641a6a972e1e
> Author: Mark Thomas <ma...@apache.org>
> AuthorDate: Fri Mar 15 17:01:47 2024 +0000
>
> Correct section title
Oops, my bad ...
Remy
> ---
> webapps/docs/changelog.xml | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
> index f945649b0c..1f7c2bf776 100644
> --- a/webapps/docs/changelog.xml
> +++ b/webapps/docs/changelog.xml
> @@ -120,7 +120,7 @@
> </add>
> </changelog>
> </subsection>
> - <subsection name="Catalina">
> + <subsection name="Coyote">
> <changelog>
> <fix>
> Add <code>threadsMaxIdleTime</code> attribute to the endpoint,
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: dev-help@tomcat.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
(tomcat) 01/04: Correct section title
Posted by ma...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
markt pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit 3e1113dcf764f90bf1720c752667641a6a972e1e
Author: Mark Thomas <ma...@apache.org>
AuthorDate: Fri Mar 15 17:01:47 2024 +0000
Correct section title
---
webapps/docs/changelog.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index f945649b0c..1f7c2bf776 100644
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -120,7 +120,7 @@
</add>
</changelog>
</subsection>
- <subsection name="Catalina">
+ <subsection name="Coyote">
<changelog>
<fix>
Add <code>threadsMaxIdleTime</code> attribute to the endpoint,
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org