From ed104c7ad0e488d57040c96974b8d0d022a775da Mon Sep 17 00:00:00 2001
From: Sina Samavati <sina.samv@gmail.com>
Date: Mon, 19 Jan 2015 20:44:57 +0330
Subject: httpc: Avoid parsing invalid 'Set-Cookie' headers

Parsing invalid 'Set-Cookie' header would make httpc crash.
This commit filters invalid 'Set-Cookie' headers so that httpc wouldn't try to parse them.
---
 lib/inets/src/http_client/httpc_cookie.erl | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

(limited to 'lib/inets/src/http_client')

diff --git a/lib/inets/src/http_client/httpc_cookie.erl b/lib/inets/src/http_client/httpc_cookie.erl
index 134115bdfa..5d71a0bb8f 100644
--- a/lib/inets/src/http_client/httpc_cookie.erl
+++ b/lib/inets/src/http_client/httpc_cookie.erl
@@ -334,9 +334,23 @@ add_domain(Str, #http_cookie{domain_default = true}) ->
 add_domain(Str, #http_cookie{domain = Domain}) ->
     Str ++ "; $Domain=" ++  Domain.
 
+is_set_cookie_valid("") ->
+    %% an empty Set-Cookie header is not valid
+    false;
+is_set_cookie_valid([$=|_]) ->
+    %% a Set-Cookie header without name is not valid
+    false;
+is_set_cookie_valid(SetCookieHeader) ->
+    %% a Set-Cookie header without name/value is not valid
+    case string:chr(SetCookieHeader, $=) of
+        0 -> false;
+        _ -> true
+    end.
+
 parse_set_cookies(CookieHeaders, DefaultPathDomain) ->
-    %% empty Set-Cookie header is invalid according to RFC but some sites violate it
-    SetCookieHeaders = [Value || {"set-cookie", Value} <- CookieHeaders, Value /= ""],
+    %% filter invalid Set-Cookie headers
+    SetCookieHeaders = [Value || {"set-cookie", Value} <- CookieHeaders,
+                                 is_set_cookie_valid(Value)],
     Cookies = [parse_set_cookie(SetCookieHeader, DefaultPathDomain) || 
 		  SetCookieHeader <- SetCookieHeaders],
     %% print_cookies("Parsed Cookies", Cookies),
-- 
cgit v1.2.3