bugfastcgi++ - Bugs: bug #32199, '+' char within a session id is...

 
 
Show feedback again

bug #32199: '+' char within a session id is replaced with ' ' when sent via cookie.

Submitted by:  Oliver Nacke <spektrum>
Submitted on:  Thu 20 Jan 2011 07:41:27 PM UTC  
 
Category: NoneSeverity: 3 - Normal
Item Group: NoneStatus: Ready For Test
Privacy: PublicAssigned to: Eddie Carle <eddic>
Open/Closed: Open

Add a New Comment (Rich MarkupRich Markup):
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Thu 10 Feb 2011 03:48:55 AM UTC, comment #5:

If you check out the latest in the boostIostreams branch there is a full fix to this problem. Unfortunately it doesn't work with the current boost builds as the patch at

http://svn.boost.org/trac/boost/ticket/5174

must be applied for this to work. If you want to rush ahead you can use the boostIostreams branch but must apply the patch at the above link to your boost installation.

Eddie Carle <eddic>
Project AdministratorIn charge of this item.
Tue 25 Jan 2011 11:23:51 PM UTC, comment #4:

I've started trying to transition the library over to boost::iostreams which will allow us to solve the issues here. Unfortunately I'm running into some road blocks. Below is a copy of the git commit message I've put into a boostIostreams branch. I'm hoping somebody could offer some insight.

The switchover involves making the Fcgistream class a
boost::iostreams::filtering_stream that has two "filters" in it. The
first component will be the "Encoding" filter that will do any
url/html/whatever encoding that needs to be done. Next in line is the
boost::iostreams::device sink that takes buffered data and forms it into
FastCGI records sending it along it's way. When the Fcgistream has a
parameter type of wchar_t, the device is encapsulated into a
boost::iostreams::code_converter adaptor to do the utf-16/32 - utf-8
code conversion.

The transition is somewhat complete save a few roadblocks I've been
running into with boost::iostreams::code_converter. I'm quite convinced
that there may be some issues in the boost code which is why I'm keeping
this as a separate branch for now. Here is an itemization of the issues.
Note all of them only occur when the device is wrapped inside a
boost::iostreams::code_converter. Otherwise we are 100%.

- I cannot change the buffer size of the code_converter. There are
parameters in it's constructor to allow for it but the buffer always
seems to be 128 bytes no matter what I tell it. This is kind of a
disaster for our purposes.
- I cannot for the life of me get the code_converter to flush its
little buffer. I pass a strict_sync() to
boost::iostreams::filtering_stream and every other component gets
flushed save the code_converter. This issue actually makes it unusable
because without being able to force flush the buffers the last bit of
each request gets chopped off and isn't sent to the client.
- For some reason, when I pass a buffer size to the code_converter (not
that it does anything) it tries to copy construct the device not with
a normal copy constructor, but some weird constructor that also takes
a const long int& as a parameter. I've created a constructor that take
said parameter and ignore it, but this is only a solution for testing
purposes.

Eddie Carle <eddic>
Project AdministratorIn charge of this item.
Sat 22 Jan 2011 12:12:22 AM UTC, comment #3:

Well, the fcgistream object is not a stringstream so there is no str() method to access it's contents. Not to mention the fact that we would have to flush before and after the insertion to insure nothing else gets encoded.

Looking into it further it doesn't look like we would actually have to code convert to utf8 as the only characters that need to be percent-encoded are some special ascii ones.

So, the cheap and dirty solution would just be some sort of templated function that takes a parameter, inserts it into a stringstream and then returns the str() method so we get.

template<class charT, class T> std::basic_string<charT> urlEncode(T session);

out << "Set-Cookie: SESSIONID=" << urlEncode<char>(session);

I really dislike the above as it is not very standard (it isn't a manipulator) and it seems very inefficient and sloppy. It seems to me that iostreams should have some facility within basic_ostream (from which fcgistream is derived) to accomplish this kind of thing. I've started perusing though my Langer & Kreft to find something but no luck so far. I've going to ask around and see if any iostreams gurus can offer any advice.

Eddie Carle <eddic>
Project AdministratorIn charge of this item.
Fri 21 Jan 2011 08:58:26 PM UTC, comment #2:

I like the idea to implement it as stream manipulator. This will keep it flexible.

I'm just wondering: Is it really such a PITA to implement? Wouldn't it be possible to just put the stream into a string/wstring, depending of the source, convert the string to utf8, and then stream it further down?

something like:

std::string tmp = ostream.str();
convert_to_utf8( tmp );
return std::ostream( tmp );

Oliver Nacke <spektrum>
Thu 20 Jan 2011 09:54:07 PM UTC, comment #1:

Yes, it looks like my URL encoding implementation is incomplete. It only works one way. I am pretty sure the standard states that cookie strings should be URL encoded so the reading of the cookie is working properly. Looks to me like the when doing a

out << "Set-Cookie: SESSIONID=" << session;

the session id needs to get properly url-encoded itself before hand.

I think a good solution would be a stream manipulator to set the next input to be url-encoded. Something like

out << "Set-Cookie: SESSIONID=" << urlEncode << session;

This is unfortunately going to be a big pain in the ass. Why? When inserting wide characters into the stream, they need to be url-encoded AFTER they are code converted to utf-8. This of course happens not in the stream but the stream buffer. Maybe some sort of queue with buffer iterators or maybe a force flushing before and after the data to be urlEncoded. Or better yet, when something is to be urlEncoded it is pre code-converted within the stream.

Any thoughts or suggestions?

Eddie Carle <eddic>
Project AdministratorIn charge of this item.
Thu 20 Jan 2011 07:41:27 PM UTC, original submission:

I use the Fastcgipp::Http::Sessions<std::string>::generate() method to create session ids. These sometimes contain a '+' char which is of course valid.
I then put the session id into a cookie and send it back to the client in order to track the session.
When the cookie is sent back by the client and I read the session id with environment().findCookie(), the '+' is replaced by ' ', leading to the session become invalid.

I use the current fastcgi++2.0 beta. This bug was not an issue in 1.2, probably introduced by the fixes regarding GET/POST data parsing.

Oliver Nacke <spektrum>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by eddic (Posted a comment)
  • -unavailable- added by spektrum (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 3 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Thu 10 Feb 2011 03:48:55 AM UTCeddicStatusIn Progress=>Ready For Test
    Mon 24 Jan 2011 04:39:09 PM UTCeddicStatusNone=>In Progress
      Assigned toNone=>eddic
    Show feedback again

    Back to the top


    Powered by Savane 3.1-cleanup