libhttp-cookies-perl: set_cookie doesn't append ".local" [rt.cpan.org #105215]

Migrated from rt.cpan.org#105215 (status was 'new')

Requestors:

• gregoa@cpan.org

From gregoa@cpan.org on 2015-06-13 18:19:55:

We have the following bug reported to the Debian package of
HTTP-Cookies (https://bugs.debian.org/788390):

It doesn't seem to be a bug in the packaging, so you may want to take
a look. Thanks!

------8<-----------8<-----------8<-----------8<-----------8<-----

Package: libhttp-cookies-perl
Version: 6.01-1
Severity: normal

Dear maintainer,

Several methods of the perl package HTTP::Cookies append ".local" at the
end of the domain where it doesn't contain a dot. add_cookie_header
performs the cookie lookup with the transformed domain ("localhost"
become "localhost.local"), and so does extract_cookies that parse the
response from the server.

But set_cookie, that allows the user to set an additional cookie by
hand, doesn't do this transformation. Thus, a cookie added to the domain
"localhost" won't be added to the request using add_cookie_header.

The fix should be as trivial as adding the following line in the
begining of the function set_cookie on line 380.

$domain = "$domain.local" unless $domain =~ /\./;

That way, the behavior of all the functions should be consistent.

Best regards,
Celelibi


-- System Information:
Debian Release: stretch/sid
  APT prefers testing
  APT policy: (990, 'testing'), (500, 'unstable'), (500, 'stable'), (1, 'experimental')
Architecture: i386 (x86_64)

Kernel: Linux 3.10.11 (SMP w/2 CPU cores; PREEMPT)
Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash
Init: sysvinit (via /sbin/init)

Versions of packages libhttp-cookies-perl depends on:
ii  libhttp-date-perl     6.02-1
ii  libhttp-message-perl  6.06-1
ii  perl                  5.20.2-6

libhttp-cookies-perl recommends no packages.

libhttp-cookies-perl suggests no packages.

-- no debconf information


------8<-----------8<-----------8<-----------8<-----------8<-----


Thanks for considering,
  gregor herrmann,
  Debian Perl Group

Start in set_cookie around line 380 and compare its domain handling with add_cookie_header and extract_cookies. Verify that setting a cookie for a domain without a dot, such as localhost, uses the same transformed domain and is included in the resulting request.