Hee Jeong Kim created HTTPCLIENT-2076:
-----------------------------------------
Summary: LaxExpiresHandler throws NullPointerException when a
value is null.
Key: HTTPCLIENT-2076
URL: https://issues.apache.org/jira/browse/HTTPCLIENT-2076
Project: HttpComponents HttpClient
Issue Type: Bug
Affects Versions: 5.0, 4.5.12
Reporter: Hee Jeong Kim
Attachments: fix_NPE_in_LaxExpiresHandler.patch
Hi. I'm using RFC6265LaxSpec and would like to report two issues.
*1. LaxExpiresHandler throws NullPointerException when a value is null.*
[This
line|https://github.com/apache/httpcomponents-client/blob/master/httpclient5/src/main/java/org/apache/hc/client5/http/impl/cookie/LaxExpiresHandler.java#L110]
line is causing NPE.
You can easily reproduce this, with the following Set-Cookie string.
Set-Cookie: gtinfo=info; Expires; domain=.webmd.com; path=/
I think We need to check whether value is blank just like how LaxMaxAgeHandler
is doing.
https://github.com/apache/httpcomponents-client/blob/master/httpclient5/src/main/java/org/apache/hc/client5/http/impl/cookie/LaxMaxAgeHandler.java#L60
*2. We need to 'ignore' invalid attributes only.*
LaxExpiresHandler throws MalformedCookieException when attribute is not valid,
so the cookie with invalid Expires attributes is ignored entirely. But [RFC
6265|https://tools.ietf.org/html/rfc6265#section-5.2.1] says, '_If the
attribute-value failed to parse as a cookie date, ignore the cookie-av._'
I think we should not throw MalformedCookieException but just ignore invalid
attributes only. LaxMaxAgeHandler is also already doing this.
https://github.com/apache/httpcomponents-client/blob/master/httpclient5/src/main/java/org/apache/hc/client5/http/impl/cookie/LaxMaxAgeHandler.java#L69
https://github.com/apache/httpcomponents-client/blob/master/httpclient5/src/main/java/org/apache/hc/client5/http/impl/cookie/LaxMaxAgeHandler.java#L61
Followings are the classes needs to be considered.
- BasicExpiresHandler
- BasicMaxAgeHandler
- LaxExpiresHandler
Thanks.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
