cURL / Mailing Lists / curl-users / Single Mail

curl-users

Re: Probable Bug in Curl cookie handling 'expires=+6s'

From: Daniel Stenberg <daniel_at_haxx.se>
Date: Mon, 15 Jan 2007 18:30:42 +0100 (CET)

On Mon, 15 Jan 2007, Farhad Tarapore wrote:

> In the 7.15.4 version of Curl, the code is not able to handle cookies of the
> form
>
> expires=+6s
>
> Ideally, such cookie values should be handled by translating them to an
> absolute timestamp.

Perhaps, but that has never been a legitimate date format in any cookie spec
that I've read.

> But Curl directly calls curl_getdate (in parsedate.c) on the '6s' string and
> results in a value of -1 for expires. This is incorrect.

Not exactly true. curl_getdate() is designed to parse legal HTTP dates (and
more) and it doesn't deal with the format you mention above. I mean, the input
is incorrect here.

> The earlier version of curl (which had getdate.c and getdate.y), used to
> take care of this and used to convert the +6s into an absolute timestamp.

Yes it did. It accepted myriads of formats, but that was then and now is now
and we had to rewrite the date parser.

> Probably some changes in date parsing have caused this to get regressed.

Indeed, and it is in fact by design. I rewrote the parser and I implemented
support for all formats I deemed necessary.

> Can you please tell me if this is a bug, or it is intended? The browser
> (Firefox 2.0.1) treats such cookies correctly i.e. it handles expires=+6s.

Browsers do all sorts of weird things and that isn't necessarily a sign that
curl should too.

But sure, if you can provide a ncie patch for curl to (re-)add support for
this I promise to consider it.

-- 
  Commercial curl and libcurl Technical Support: http://haxx.se/curl.html
Received on 2007-01-15