[ ijbswa-Bugs-3403560 ] session-cookies-only and expires with a two digit year

Bugs item #3403560, was opened at 2011-09-03 04:49
Message generated for change (Tracker Item Submitted) made by vah78
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=111118&aid=3403560&group_id=11118

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: None
Group: version 3.0.17
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: Väinö (vah78)
Assigned to: Nobody/Anonymous (nobody)
Summary: session-cookies-only and expires with a two digit year

Initial Comment:
I noticed that if cookie's expires date has a two digit year, the expires date is not removed, and thus, the cookies are not converted to session only cookies.

For example, if a server sets these headers:
Set-Cookie: test1=37; expires=Tue, 02-Jun-37 20:00:00 GMT
Set-Cookie: test2=2037; expires=Tue, 02-Jun-2037 20:00:00 GMT

They will come trough Privoxy with session-cookies-only enabled as:
Set-Cookie: test1=37; expires=Tue, 02-Jun-37 20:00:00 GMT
Set-Cookie: test2=2037;

I believe the problem is in the parse_header_time() function (in parsetime.c). It uses strptime() which will parse the two digit year incorrectly and gmt.tm_year will become negative (-1863). This will cause the rest of the logic to believe that the date is in the past and the server wants to delete the cookie.

A possible fix is to reorder the strptime() calls to try the two digit year format first. Or the function could be hacked to give correct results by adding 2000 to tm_year if it is negative. It might be a bit faster to keep the most often used date format at the top but it would be ugly.

If you want to see such a cookie in the wild, you can try this but I'm sure there are other examples:
% curl -I www.mtv3.fi

I'm using 64-bit Linux (Debian and Arch) in case the strptime() functions differently in other platforms. My Privoxy is version 3.0.17 from Debian repositories. I also downloaded the lastest stable source directly from sf.net for finding where the bug is.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=111118&aid=3403560&group_id=11118

------------------------------------------------------------------------------
Special Offer -- Download ArcSight Logger for FREE!
Finally, a world-class log management solution at an even better 
price-free! And you'll get a free "Love Thy Logs" t-shirt when you
download Logger. Secure your free ArcSight Logger TODAY!
http://p.sf.net/sfu/arcsisghtdev2dev
_______________________________________________
Ijbswa-developers mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/ijbswa-developers