procyberian/emacs
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

(url-cookie-host-can-set-p): Protect against zero-length domains

Browse source 
* lisp/url/url-cookie.el (url-cookie-host-can-set-p): Protect
against zero-length domains.

Backtrace of a real-world site that triggers a bug:

Debugger entered--Lisp error: (args-out-of-range "" 0)
  url-cookie-host-can-set-p("www.washingtonpost.com" "")
  url-cookie-handle-set-cookie("utm_term=0;Expires=Thursday,
  01-January-1970 00:00:00 GMT; path=/; domain=")
  url-http-handle-cookies()
This commit is contained in:
Lars Ingebrigtsen 2017-06-07 16:17:47 +02:00
parent 43885eac09
commit 6252386378
1 changed files with 7 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
lisp/url/url-cookie.el
View file

@ -229,16 +229,19 @@ telling Microsoft that."
(defun url-cookie-host-can-set-p (host domain)
(let ((last nil)
(case-fold-search t))
(if (string= host domain) ; Apparently netscape lets you do this
t
(cond
((string= host domain) ; Apparently netscape lets you do this
t)
((zerop (length domain))
nil)
(t
;; Remove the dot from wildcard domains before matching.
(when (eq ?. (aref domain 0))
(setq domain (substring domain 1)))
(and (url-domsuf-cookie-allowed-p domain)
;; Need to check and make sure the host is actually _in_ the
;; domain it wants to set a cookie for though.
(string-match (concat (regexp-quote domain)
"$") host)))))
(string-match (concat (regexp-quote domain) "$") host))))))
(defun url-cookie-handle-set-cookie (str)
(setq url-cookies-changed-since-last-save t)