[#94657] [Ruby master Feature#16131] Remove $SAFE, taint and trust — naruse@...
Issue #16131 has been reported by naruse (Yui NARUSE).
3 messages
2019/08/29
[ruby-core:94183] [Ruby master Bug#16052] net/http get_fields doesn't return correct value for set-cookie
From:
MarioRuizS@...
Date:
2019-08-07 14:25:46 UTC
List:
ruby-core #94183
Issue #16052 has been reported by MarioRuiz (Mario Ruiz S=E1nchez).
----------------------------------------
Bug #16052: net/http get_fields doesn't return correct value for set-cookie
https://bugs.ruby-lang.org/issues/16052
* Author: MarioRuiz (Mario Ruiz S=E1nchez)
* Status: Open
* Priority: Normal
* Assignee: =
* Target version: =
* ruby -v: 2.6.3
* Backport: 2.5: UNKNOWN, 2.6: UNKNOWN
----------------------------------------
This is the code that reproduces the problem:
``` ruby
require 'net/http'
require 'net/https'
path =3D "/authorize?client_id=3DkbyuFDidLLm280LIwVFiazOqjO3ty8KH&respons=
e_type=3Dcode"
http =3D Net::HTTP.new('samples.auth0.com', 443)
http.use_ssl =3D true
http.start
resp =3D http.get(path)
p resp[:'set-cookie']
p resp['set-cookie']
resp[:'set-cookie'] =3D resp['set-cookie']
p resp[:'set-cookie']
p resp['set-cookie']
p resp.get_fields('set-cookie')
```
On Ruby 2.5.1 this is the output:
nil
"did=3Ds%3Av0%3Acf7f3a90-b91e-11e9-bf5d-25ae2d9eb2c4.IBWyPWhpTfJPWpjNMmTdWZ=
%2BjBrJMiGqfB%2B%2BlMkPiJ1o; Max-Age=3D157788000; Path=3D/; Expires=3DTue, =
06 Aug 2024 20:22:39 GMT; HttpOnly; Secure, auth0=3Ds%3Az7GYMZaYa-uuoDoR_r0=
cKOvabZtiBOkS.CJdk9IkLJpTrOUXKfEGLgAnJm%2B%2BRUooYzZD5Bg5F5Ps; Path=3D/; Ex=
pires=3DSat, 10 Aug 2019 14:22:39 GMT; HttpOnly; Secure"
"did=3Ds%3Av0%3Acf7f3a90-b91e-11e9-bf5d-25ae2d9eb2c4.IBWyPWhpTfJPWpjNMmTdWZ=
%2BjBrJMiGqfB%2B%2BlMkPiJ1o; Max-Age=3D157788000; Path=3D/; Expires=3DTue, =
06 Aug 2024 20:22:39 GMT; HttpOnly; Secure, auth0=3Ds%3Az7GYMZaYa-uuoDoR_r0=
cKOvabZtiBOkS.CJdk9IkLJpTrOUXKfEGLgAnJm%2B%2BRUooYzZD5Bg5F5Ps; Path=3D/; Ex=
pires=3DSat, 10 Aug 2019 14:22:39 GMT; HttpOnly; Secure"
"did=3Ds%3Av0%3Acf7f3a90-b91e-11e9-bf5d-25ae2d9eb2c4.IBWyPWhpTfJPWpjNMmTdWZ=
%2BjBrJMiGqfB%2B%2BlMkPiJ1o; Max-Age=3D157788000; Path=3D/; Expires=3DTue, =
06 Aug 2024 20:22:39 GMT; HttpOnly; Secure, auth0=3Ds%3Az7GYMZaYa-uuoDoR_r0=
cKOvabZtiBOkS.CJdk9IkLJpTrOUXKfEGLgAnJm%2B%2BRUooYzZD5Bg5F5Ps; Path=3D/; Ex=
pires=3DSat, 10 Aug 2019 14:22:39 GMT; HttpOnly; Secure"
["did=3Ds%3Av0%3Acf7f3a90-b91e-11e9-bf5d-25ae2d9eb2c4.IBWyPWhpTfJPWpjNMmTdW=
Z%2BjBrJMiGqfB%2B%2BlMkPiJ1o; Max-Age=3D157788000; Path=3D/; Expires=3DTue,=
06 Aug 2024 20:22:39 GMT; HttpOnly; Secure", "auth0=3Ds%3Az7GYMZaYa-uuoDoR=
_r0cKOvabZtiBOkS.CJdk9IkLJpTrOUXKfEGLgAnJm%2B%2BRUooYzZD5Bg5F5Ps; Path=3D/;=
Expires=3DSat, 10 Aug 2019 14:22:39 GMT; HttpOnly; Secure"]
The first p resp[:'set-cookie'] returns nil and get_fields returns an array=
of two elements.
When running that code on Ruby 2.6.3
"did=3Ds%3Av0%3A84199fa0-b91e-11e9-b07e-63edc59883b4.WbrSsi6W9fe1qJBMTC4xQh=
n3HewT121huAZ597Fz3Pg; Max-Age=3D157788000; Path=3D/; Expires=3DTue, 06 Aug=
2024 20:20:32 GMT; HttpOnly; Secure, auth0=3Ds%3AEBmv1xWqukwMjYxrWssv735VQ=
ZFAMby3.r1eoqEebr4tGVTiOUNMvp%2BS0rx5D1mm9pgKYnE6CXMk; Path=3D/; Expires=3D=
Sat, 10 Aug 2019 14:20:32 GMT; HttpOnly; Secure"
"did=3Ds%3Av0%3A84199fa0-b91e-11e9-b07e-63edc59883b4.WbrSsi6W9fe1qJBMTC4xQh=
n3HewT121huAZ597Fz3Pg; Max-Age=3D157788000; Path=3D/; Expires=3DTue, 06 Aug=
2024 20:20:32 GMT; HttpOnly; Secure, auth0=3Ds%3AEBmv1xWqukwMjYxrWssv735VQ=
ZFAMby3.r1eoqEebr4tGVTiOUNMvp%2BS0rx5D1mm9pgKYnE6CXMk; Path=3D/; Expires=3D=
Sat, 10 Aug 2019 14:20:32 GMT; HttpOnly; Secure"
"did=3Ds%3Av0%3A84199fa0-b91e-11e9-b07e-63edc59883b4.WbrSsi6W9fe1qJBMTC4xQh=
n3HewT121huAZ597Fz3Pg; Max-Age=3D157788000; Path=3D/; Expires=3DTue, 06 Aug=
2024 20:20:32 GMT; HttpOnly; Secure, auth0=3Ds%3AEBmv1xWqukwMjYxrWssv735VQ=
ZFAMby3.r1eoqEebr4tGVTiOUNMvp%2BS0rx5D1mm9pgKYnE6CXMk; Path=3D/; Expires=3D=
Sat, 10 Aug 2019 14:20:32 GMT; HttpOnly; Secure"
"did=3Ds%3Av0%3A84199fa0-b91e-11e9-b07e-63edc59883b4.WbrSsi6W9fe1qJBMTC4xQh=
n3HewT121huAZ597Fz3Pg; Max-Age=3D157788000; Path=3D/; Expires=3DTue, 06 Aug=
2024 20:20:32 GMT; HttpOnly; Secure, auth0=3Ds%3AEBmv1xWqukwMjYxrWssv735VQ=
ZFAMby3.r1eoqEebr4tGVTiOUNMvp%2BS0rx5D1mm9pgKYnE6CXMk; Path=3D/; Expires=3D=
Sat, 10 Aug 2019 14:20:32 GMT; HttpOnly; Secure"
["did=3Ds%3Av0%3A84199fa0-b91e-11e9-b07e-63edc59883b4.WbrSsi6W9fe1qJBMTC4xQ=
hn3HewT121huAZ597Fz3Pg; Max-Age=3D157788000; Path=3D/; Expires=3DTue, 06 Au=
g 2024 20:20:32 GMT; HttpOnly; Secure, auth0=3Ds%3AEBmv1xWqukwMjYxrWssv735V=
QZFAMby3.r1eoqEebr4tGVTiOUNMvp%2BS0rx5D1mm9pgKYnE6CXMk; Path=3D/; Expires=
=3DSat, 10 Aug 2019 14:20:32 GMT; HttpOnly; Secure"]
The first p resp[:'set-cookie'] returns a value and get_fields returns an a=
rray of 1 element.
-- =
https://bugs.ruby-lang.org/
Unsubscribe: <mailto:[email protected]?subject=3Dunsubscribe>
<http://lists.ruby-lang.org/cgi-bin/mailman/options/ruby-core>