You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by ma...@apache.org on 2008/03/08 00:39:33 UTC
svn commit: r634863 - /tomcat/tc6.0.x/trunk/STATUS.txt
Author: markt
Date: Fri Mar 7 15:39:30 2008
New Revision: 634863
URL: http://svn.apache.org/viewvc?rev=634863&view=rev
Log:
vote
Modified:
tomcat/tc6.0.x/trunk/STATUS.txt
Modified: tomcat/tc6.0.x/trunk/STATUS.txt
URL: http://svn.apache.org/viewvc/tomcat/tc6.0.x/trunk/STATUS.txt?rev=634863&r1=634862&r2=634863&view=diff
==============================================================================
--- tomcat/tc6.0.x/trunk/STATUS.txt (original)
+++ tomcat/tc6.0.x/trunk/STATUS.txt Fri Mar 7 15:39:30 2008
@@ -104,5 +104,10 @@
for v0 cookies.
http://svn.apache.org/viewvc?view=rev&revision=634513
+1: fhanik
+ -0: markt If the current code thinks the path needs quoting then you
+ are in very uncertain territory for v0 cookies anyway and
+ the chances are that something is going to break. I would
+ rather keep the consistency of the quoting that might
+ break a browser that have inconsistent handling of
+ elements of the cookie header.
-1:
-
\ No newline at end of file
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: svn commit: r634863 - /tomcat/tc6.0.x/trunk/STATUS.txt
Posted by Mark Thomas <ma...@apache.org>.
Filip Hanik - Dev Lists wrote:
> Mark Thomas wrote:
>> The version switch is activated by a greater set of characters than it
>> really needs to be. I should be able to modify my patch to only switch
>> when there are characters in a v1 cookie that will cause problems.
>> I'll try and look at this tomorrow - it is getting late here ;)
> other way around, the check for the characters and the version switch,
> should be done on all invalid v0 characters (which maybeQuote2 does).
> this should only be done on the value, with that set of characters.
Sorry - it really was late - I meant v0.
I agree that tspecials2 is too wide a range of characters to trigger the
switch but equally I don't think tspecials are sufficient. As a minimum,
'=' also needs to trigger the switch as this will cause parsing problems if
it appears in the value/path/domain. For safety I would like to include
'\\' and '\"' as well but I don't think they are strictly necessary.
Due to the parsing issues, mainly if '=' is present, we should continue to
check domain and path and switch to v1 if required but the much reduced set
of triggers this should be a lot less likely.
I have a better patch but I haven't tested it yet. I should have it ready
to propose later this evening.
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: svn commit: r634863 - /tomcat/tc6.0.x/trunk/STATUS.txt
Posted by Filip Hanik - Dev Lists <de...@hanik.com>.
Mark Thomas wrote:
> Filip Hanik - Dev Lists wrote:
>> Mark Thomas wrote:
>>> Filip Hanik - Dev Lists wrote:
>>>> actually, IE only supports quoting of the value for v0 cookies.
>>>> honestly, I wasn't up for the backwards compatible fix, but since
>>>> it turns out that most folks use v0 cookies with v1 values, this is
>>>> an evil must.
>>>>
>>>> without the below fix, every single JSESSIONID cookie will not work
>>>> on IE.
>>>
>>> That's not good.
>>>
>>> I've looked at this again and the real problem is that maybeQuote2()
>>> may change the cookie version but we only check the return value
>>> when calling maybeQuote2() for the value. We need to check the
>>> return value every time we call maybeQuote2(). I have an alternative
>>> patch which I'll add to the status file.
>> I don't think that we should change the cookie version simply because
>> "/" is the path, that doesn't sound right, nor is it required by spec.
>
> Very true.
>
>> I'd rather just do the switch upon values containing funky
>> characters...if at all, and maybe just follow spec, and not allow the
>> bad v0 values at all, like the original fix was.
>
> The version switch is activated by a greater set of characters than it
> really needs to be. I should be able to modify my patch to only switch
> when there are characters in a v1 cookie that will cause problems.
> I'll try and look at this tomorrow - it is getting late here ;)
other way around, the check for the characters and the version switch,
should be done on all invalid v0 characters (which maybeQuote2 does).
this should only be done on the value, with that set of characters.
Filip
>
> Mark
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: dev-help@tomcat.apache.org
>
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: svn commit: r634863 - /tomcat/tc6.0.x/trunk/STATUS.txt
Posted by Mark Thomas <ma...@apache.org>.
Filip Hanik - Dev Lists wrote:
> Mark Thomas wrote:
>> Filip Hanik - Dev Lists wrote:
>>> actually, IE only supports quoting of the value for v0 cookies.
>>> honestly, I wasn't up for the backwards compatible fix, but since it
>>> turns out that most folks use v0 cookies with v1 values, this is an
>>> evil must.
>>>
>>> without the below fix, every single JSESSIONID cookie will not work
>>> on IE.
>>
>> That's not good.
>>
>> I've looked at this again and the real problem is that maybeQuote2()
>> may change the cookie version but we only check the return value when
>> calling maybeQuote2() for the value. We need to check the return value
>> every time we call maybeQuote2(). I have an alternative patch which
>> I'll add to the status file.
> I don't think that we should change the cookie version simply because
> "/" is the path, that doesn't sound right, nor is it required by spec.
Very true.
> I'd rather just do the switch upon values containing funky
> characters...if at all, and maybe just follow spec, and not allow the
> bad v0 values at all, like the original fix was.
The version switch is activated by a greater set of characters than it
really needs to be. I should be able to modify my patch to only switch when
there are characters in a v1 cookie that will cause problems. I'll try and
look at this tomorrow - it is getting late here ;)
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: svn commit: r634863 - /tomcat/tc6.0.x/trunk/STATUS.txt
Posted by Filip Hanik - Dev Lists <de...@hanik.com>.
Mark Thomas wrote:
> Filip Hanik - Dev Lists wrote:
>> actually, IE only supports quoting of the value for v0 cookies.
>> honestly, I wasn't up for the backwards compatible fix, but since it
>> turns out that most folks use v0 cookies with v1 values, this is an
>> evil must.
>>
>> without the below fix, every single JSESSIONID cookie will not work
>> on IE.
>
> That's not good.
>
> I've looked at this again and the real problem is that maybeQuote2()
> may change the cookie version but we only check the return value when
> calling maybeQuote2() for the value. We need to check the return value
> every time we call maybeQuote2(). I have an alternative patch which
> I'll add to the status file.
I don't think that we should change the cookie version simply because
"/" is the path, that doesn't sound right, nor is it required by spec.
I'd rather just do the switch upon values containing funky
characters...if at all, and maybe just follow spec, and not allow the
bad v0 values at all, like the original fix was.
Filip
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: svn commit: r634863 - /tomcat/tc6.0.x/trunk/STATUS.txt
Posted by Mark Thomas <ma...@apache.org>.
Filip Hanik - Dev Lists wrote:
> actually, IE only supports quoting of the value for v0 cookies.
> honestly, I wasn't up for the backwards compatible fix, but since it
> turns out that most folks use v0 cookies with v1 values, this is an evil
> must.
>
> without the below fix, every single JSESSIONID cookie will not work on IE.
That's not good.
I've looked at this again and the real problem is that maybeQuote2() may
change the cookie version but we only check the return value when calling
maybeQuote2() for the value. We need to check the return value every time
we call maybeQuote2(). I have an alternative patch which I'll add to the
status file.
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: svn commit: r634863 - /tomcat/tc6.0.x/trunk/STATUS.txt
Posted by Filip Hanik - Dev Lists <de...@hanik.com>.
actually, IE only supports quoting of the value for v0 cookies.
honestly, I wasn't up for the backwards compatible fix, but since it
turns out that most folks use v0 cookies with v1 values, this is an evil
must.
without the below fix, every single JSESSIONID cookie will not work on IE.
Filip
markt@apache.org wrote:
> Author: markt
> Date: Fri Mar 7 15:39:30 2008
> New Revision: 634863
>
> URL: http://svn.apache.org/viewvc?rev=634863&view=rev
> Log:
> vote
>
> Modified:
> tomcat/tc6.0.x/trunk/STATUS.txt
>
> Modified: tomcat/tc6.0.x/trunk/STATUS.txt
> URL: http://svn.apache.org/viewvc/tomcat/tc6.0.x/trunk/STATUS.txt?rev=634863&r1=634862&r2=634863&view=diff
> ==============================================================================
> --- tomcat/tc6.0.x/trunk/STATUS.txt (original)
> +++ tomcat/tc6.0.x/trunk/STATUS.txt Fri Mar 7 15:39:30 2008
> @@ -104,5 +104,10 @@
> for v0 cookies.
> http://svn.apache.org/viewvc?view=rev&revision=634513
> +1: fhanik
> + -0: markt If the current code thinks the path needs quoting then you
> + are in very uncertain territory for v0 cookies anyway and
> + the chances are that something is going to break. I would
> + rather keep the consistency of the quoting that might
> + break a browser that have inconsistent handling of
> + elements of the cookie header.
> -1:
> -
> \ No newline at end of file
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: dev-help@tomcat.apache.org
>
>
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org