[
https://issues.apache.org/jira/browse/TS-4653?focusedWorklogId=25745&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-25745
]
ASF GitHub Bot logged work on TS-4653:
--------------------------------------
Author: ASF GitHub Bot
Created on: 20/Jul/16 09:45
Start Date: 20/Jul/16 09:45
Worklog Time Spent: 10m
Work Description: Github user bryancall commented on a diff in the pull
request:
https://github.com/apache/trafficserver/pull/798#discussion_r71495348
--- Diff: plugins/experimental/esi/lib/Variables.cc ---
@@ -357,9 +357,25 @@ Variables::_parseCookieString(const char *str, int
str_len)
AttributeList cookies;
Utils::parseAttributes(str, str_len, cookies, ";,");
for (AttributeList::iterator iter = cookies.begin(); iter !=
cookies.end(); ++iter) {
- _insert(_dict_data[HTTP_COOKIE], string(iter->name, iter->name_len),
string(iter->value, iter->value_len));
- _debugLog(_debug_tag, "[%s] Inserted cookie with name [%.*s] and value
[%.*s]", __FUNCTION__, iter->name_len, iter->name,
- iter->value_len, iter->value);
+ std::string v = iter->name;
--- End diff --
The variable names are not chosen well. Can you please not use 1 or 2
characters for variable names.
Issue Time Tracking
-------------------
Worklog Id: (was: 25745)
Time Spent: 3h 40m (was: 3.5h)
> ESI plugin - $HTTP_COOKIE can leak important cookie info unintentionally
> ------------------------------------------------------------------------
>
> Key: TS-4653
> URL: https://issues.apache.org/jira/browse/TS-4653
> Project: Traffic Server
> Issue Type: Bug
> Components: Plugins
> Reporter: Kit Chan
> Assignee: Kit Chan
> Fix For: 7.0.0
>
> Time Spent: 3h 40m
> Remaining Estimate: 0h
>
> In the ESI spec, we can print out cookie information with $HTTP_COOKIE. This
> can be problematic and unintentionally print out sensitive info on a web page.
> We should have mechanism to disable this by default and allow us to fine tune
> it so we can choose to expose this functionality for only the cookie that we
> allow
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
