mitre / mitre/HTTP-Proxy-Servlet

cookie解析有误

Open
#175 2 comments 4 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Java
Stars
1.5k
Forks
557
PR merge metrics
No merged PRs in 30d

Description

/**
   * Take any client cookies that were originally from the proxy and prepare them to send to the
   * proxy.  This relies on cookie headers being set correctly according to RFC 6265 Sec 5.4.
   * This also blocks any local cookies from being sent to the proxy.
   */
  protected String getRealCookie(String cookieValue) {
    StringBuilder escapedCookie = new StringBuilder();
    String cookies[] = cookieValue.split("[;,]");
    for (String cookie : cookies) {
      String cookieSplit[] = cookie.split("=");
      if (cookieSplit.length == 2) {
        String cookieName = cookieSplit[0].trim();
        if (cookieName.startsWith(getCookieNamePrefix(cookieName))) {
          cookieName = cookieName.substring(getCookieNamePrefix(cookieName).length());
          if (escapedCookie.length() > 0) {
            escapedCookie.append("; ");
          }
          escapedCookie.append(cookieName).append("=").append(cookieSplit[1].trim());
        }
      }
    }
    return escapedCookie.toString();
  }

这个方法中String cookieSplit[] = cookie.split("="); 这一行,使用“=”分割是不健壮的,如果cookie的value中正好含有“=”,那么就会出错,例如我在访问某个交换机的http网站服务时,有个cookie是这样的:index==0b=06=0AB00=0R

建议找到第一个“=”然后使用substring截取,以下是我重写后的:

@Override
    protected String getRealCookie(String cookieValue) {
        StringBuilder escapedCookie = new StringBuilder();
        String cookies[] = cookieValue.split("[;,]");
        for (String cookie : cookies) {
            int index = cookie.indexOf("=");
            if (index>0){
                String cookieName = cookie.substring(0,index).trim();
                if (escapedCookie.length() > 0) {
                    escapedCookie.append("; ");
                }
                escapedCookie.append(cookieName).append("=").append(cookie.substring(index+1).trim());
            }
        }
        return escapedCookie.toString();
    }

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Search the Java source for getRealCookie(String) and read the existing cookie handling around the split on '='. Reproduce the reported case with a cookie value containing additional '=' characters, then verify that the original cookie name and complete value are preserved in the returned proxy cookie string. Add or update focused coverage if the repository has tests for this method.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
networking
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.