[Mailman-Developers] Bug Found in Mailman

[Harald Meland]

[Ricardo Kustner]

> On Wed, Jun 07, 2000 at 04:21:06PM +0200, Andrea Paparelli wrote:
> > Bug in Mailman version 1.1
> >   File "/home/staff/mailman/Mailman/SecurityManager.py", line 117, in
> > CheckCookie
> >     if cookiedata[keylen+1] <> '"' and cookiedata[-1] <> '"':
> > IndexError: string index out of range
> 
> I stumbled on this a few times too... but it is very hard to reproduce...
> what I think went wrong in my situation most of those times is that somehow
> the cookie got mixed up with a different cookie which was set by a different
> program at the exact same server as mailman...
> anybody had simular experiences?

I haven't seen this happen with my users, but as the offending piece
of code indeed is a hack that won't work reliably if the browser sends
multiple cookies, I think this should be addressed somehow.

The real problem, I think, is that there's confusion on the subject of
cookie content syntax.

The original Netscape proposal uses this (not very well-defined, IMO)
cookie content syntax:

: NAME=VALUE
:      This string is a sequence of characters excluding semi-colon,
:      comma and white space. If there is a need to place such data in
:      the name or value, some encoding method such as URL style %XX
:      encoding is recommended, though no encoding is defined or
:      required.

A quick example:
[ Server -> Client ]
  Set-Cookie: CUSTOMER=WILE_E_COYOTE; path=/; expires=Wednesday, 09-Nov-99 23:12:40 GMT

[ Client -> Server ]
  Cookie: CUSTOMER=WILE_E_COYOTE

Note that there are no quotes around the cookie value.


RFC 2109, however, has a more well-defined, but ever so slightly
different content syntax:

: 4.1  Syntax:  General
: 
:    The two state management headers, Set-Cookie and Cookie, have common
:    syntactic properties involving attribute-value pairs.  The following
:    grammar uses the notation, and tokens DIGIT (decimal digits) and
:    token (informally, a sequence of non-special, non-white space
:    characters) from the HTTP/1.1 specification [RFC 2068] to describe
:    their syntax.
: 
:    av-pairs        =       av-pair *(";" av-pair)
:    av-pair         =       attr ["=" value]        ; optional value
:    attr            =       token
:    value           =       word
:    word            =       token | quoted-string

Note that the cookies value can be a quoted-string.  The example from
the Netscape spec could look like this using the RFC syntax:

[ Server -> Client ]
  Set-Cookie: CUSTOMER="WILE_E_COYOTE"; Version="1"; Path="/"; Max-Age="3600"

[ Client -> Server ]
  Cookie: $Version="1"; CUSTOMER="WILE_E_COYOTE"; $Path="/"


(Some time back) I looked over misc/Cookie.py trying to find some way
to make it cope reliably with both kinds of cookies, but wasn't really
able to discover what's wrong with _CookiePattern :(

I suspect that using "Max-Age" attributes on Mailman cookies instead
of the current (non-RFC) "Expires" attribute *might* help, but I
really don't have any idea whether such a change will stop Mailman
from working with certain browsers.
-- 
Harald