[
https://issues.apache.org/jira/browse/HTTPCLIENT-2076?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Oleg Kalnichevski resolved HTTPCLIENT-2076.
-------------------------------------------
Fix Version/s: 5.0.1
4.5.13
Resolution: Fixed
Fixed in master and 4.5.x.
Oleg
> LaxExpiresHandler throws NullPointerException when a value is null.
> -------------------------------------------------------------------
>
> Key: HTTPCLIENT-2076
> URL: https://issues.apache.org/jira/browse/HTTPCLIENT-2076
> Project: HttpComponents HttpClient
> Issue Type: Bug
> Affects Versions: 4.5.12, 5.0
> Reporter: Hee Jeong Kim
> Priority: Minor
> Fix For: 4.5.13, 5.0.1
>
> Attachments: fix_NPE_in_LaxExpiresHandler.patch
>
> Time Spent: 50m
> Remaining Estimate: 0h
>
> Hi. I'm using RFC6265LaxSpec and would like to report two issues.
> *1. LaxExpiresHandler throws NullPointerException when a value is null.*
> [This
> line|https://github.com/apache/httpcomponents-client/blob/master/httpclient5/src/main/java/org/apache/hc/client5/http/impl/cookie/LaxExpiresHandler.java#L110]
> line is causing NPE.
> You can easily reproduce this, with the following Set-Cookie string.
> Set-Cookie: gtinfo=info; Expires; domain=.webmd.com; path=/
> I think We need to check whether value is blank just like how
> LaxMaxAgeHandler is doing.
> https://github.com/apache/httpcomponents-client/blob/master/httpclient5/src/main/java/org/apache/hc/client5/http/impl/cookie/LaxMaxAgeHandler.java#L60
> *2. We need to 'ignore' invalid attributes only.*
> LaxExpiresHandler throws MalformedCookieException when attribute is not
> valid, so the cookie with invalid Expires attributes is ignored entirely. But
> [RFC 6265|https://tools.ietf.org/html/rfc6265#section-5.2.1] says, '_If the
> attribute-value failed to parse as a cookie date, ignore the cookie-av._'
> I think we should not throw MalformedCookieException but just ignore invalid
> attributes only. LaxMaxAgeHandler is also already doing this.
> https://github.com/apache/httpcomponents-client/blob/master/httpclient5/src/main/java/org/apache/hc/client5/http/impl/cookie/LaxMaxAgeHandler.java#L69
> https://github.com/apache/httpcomponents-client/blob/master/httpclient5/src/main/java/org/apache/hc/client5/http/impl/cookie/LaxMaxAgeHandler.java#L61
> Followings are the classes needs to be considered.
> - BasicExpiresHandler
> - BasicMaxAgeHandler
> - LaxExpiresHandler
> Thanks.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
