[jira] [Created] (HTTPCLIENT-2076) LaxExpiresHandler throws NullPointerException when a value is null.

["Hee Jeong Kim (Jira)" <ji...@apache.org>]

Hee Jeong Kim created HTTPCLIENT-2076:
-----------------------------------------

             Summary: LaxExpiresHandler throws NullPointerException when a value is null.
                 Key: HTTPCLIENT-2076
                 URL: https://issues.apache.org/jira/browse/HTTPCLIENT-2076
             Project: HttpComponents HttpClient
          Issue Type: Bug
    Affects Versions: 5.0, 4.5.12
            Reporter: Hee Jeong Kim
         Attachments: fix_NPE_in_LaxExpiresHandler.patch

Hi. I'm using RFC6265LaxSpec and would like to report two issues.

*1. LaxExpiresHandler throws NullPointerException when a value is null.*

[This line|https://github.com/apache/httpcomponents-client/blob/master/httpclient5/src/main/java/org/apache/hc/client5/http/impl/cookie/LaxExpiresHandler.java#L110] line is causing NPE.
You can easily reproduce this, with the following Set-Cookie string.
Set-Cookie: gtinfo=info; Expires; domain=.webmd.com; path=/

I think We need to check whether value is blank just like how LaxMaxAgeHandler is doing.
https://github.com/apache/httpcomponents-client/blob/master/httpclient5/src/main/java/org/apache/hc/client5/http/impl/cookie/LaxMaxAgeHandler.java#L60


*2. We need to 'ignore' invalid attributes only.*

LaxExpiresHandler throws MalformedCookieException when attribute is not valid, so the cookie with invalid Expires attributes is ignored entirely. But [RFC 6265|https://tools.ietf.org/html/rfc6265#section-5.2.1] says, '_If the attribute-value failed to parse as a cookie date, ignore the cookie-av._' 



I think we should not throw MalformedCookieException but just ignore invalid attributes only. LaxMaxAgeHandler is also already doing this.
https://github.com/apache/httpcomponents-client/blob/master/httpclient5/src/main/java/org/apache/hc/client5/http/impl/cookie/LaxMaxAgeHandler.java#L69
https://github.com/apache/httpcomponents-client/blob/master/httpclient5/src/main/java/org/apache/hc/client5/http/impl/cookie/LaxMaxAgeHandler.java#L61

Followings are the classes needs to be considered.
- BasicExpiresHandler
- BasicMaxAgeHandler
- LaxExpiresHandler

Thanks.



--
This message was sent by Atlassian Jira
(v8.3.4#803005)

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
For additional commands, e-mail: dev-help@hc.apache.org