Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

net/http/cookiejar: CookieJar does not safely create keys from hosts #19384

Closed
xeoncross opened this issue Mar 3, 2017 · 4 comments
Closed

net/http/cookiejar: CookieJar does not safely create keys from hosts #19384

xeoncross opened this issue Mar 3, 2017 · 4 comments
Labels
FrozenDueToAge help wanted NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one.
Milestone
Go1.9

Comments

@xeoncross
Copy link

xeoncross commented Mar 3, 2017 •
edited

What version of Go are you using (go version)?

go version go1.7.4 darwin/amd64

What operating system and processor architecture are you using (go env)?

GOARCH="amd64"
GOBIN="/Users/user/go//bin"
GOEXE=""
GOHOSTARCH="amd64"
GOHOSTOS="darwin"
GOOS="darwin"
GOPATH="/Users/user/go/"
GORACE=""
GOROOT="/usr/local/Cellar/go/1.7.4/libexec"
GOTOOLDIR="/usr/local/Cellar/go/1.7.4/libexec/pkg/tool/darwin_amd64"
CC="clang"
GOGCCFLAGS="-fPIC -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=/var/folders/n0/7jgcgsvs15q4r63w4z0nrpbr0000gp/T/go-build841391109=/tmp/go-build -gno-record-gcc-switches -fno-common"
CXX="clang++"
CGO_ENABLED="1"

What did you do?

Using http.CookieJar with http.Client and github.com/viki-org/dnscache I have had some failed DNS lookups which reveled a bug in jarKey() when an invalid host string is given. Unfortunately I am having trouble re-creating this issue from the application.

What did you expect to see?

Nothing

What did you see instead?

panic: runtime error: slice bounds out of range

goroutine 85 [running]:
panic(0x43110e0, 0xc42000c110)
	/usr/local/Cellar/go/1.7.4/libexec/src/runtime/panic.go:500 +0x1a1
net/http/cookiejar.jarKey(0xc4201593d7, 0x1, 0x0, 0x0, 0x0, 0x0)
	/usr/local/Cellar/go/1.7.4/libexec/src/net/http/cookiejar/jar.go:356 +0x145
net/http/cookiejar.(*Jar).cookies(0xc42021a030, 0xc42008f200, 0xed04bcaa3, 0x28ab5878, 0x46057a0, 0x0, 0x0, 0x0)
	/usr/local/Cellar/go/1.7.4/libexec/src/net/http/cookiejar/jar.go:184 +0x154
net/http/cookiejar.(*Jar).Cookies(0xc42021a030, 0xc42008f200, 0x0, 0x0, 0x1)
	/usr/local/Cellar/go/1.7.4/libexec/src/net/http/cookiejar/jar.go:172 +0x55
net/http.(*Client).send(0x45e3780, 0xc4200cec30, 0xed04bcac1, 0x28ab5562, 0x46057a0, 0xc42002a478, 0x0, 0x1)
	/usr/local/Cellar/go/1.7.4/libexec/src/net/http/client.go:142 +0x4e
net/http.(*Client).doFollowingRedirects(0x45e3780, 0xc4200cec30, 0x43a69d0, 0x3, 0x40b8001, 0xc4202c24d8)
	/usr/local/Cellar/go/1.7.4/libexec/src/net/http/client.go:528 +0x5e5
net/http.(*Client).Do(0x45e3780, 0xc4200cec30, 0xa, 0x438b234, 0x79)
	/usr/local/Cellar/go/1.7.4/libexec/src/net/http/client.go:184 +0x1ea
app/httpclient.GetRequest(0xc4201593d0, 0x9, 0x7d000, 0xc42015d1a0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ...)
	/Users/user/go/src/app/httpclient/httpclient.go:141 +0x1c7
exit status 2


The last line of my code is 

  141: 	resp, err := client.Do(req)

For my current Go 1.7 source here is the line 356:

332 // jarKey returns the key to use for a jar.
333 func jarKey(host string, psl PublicSuffixList) string {
334         if isIP(host) {
335                 return host
336         }
337 
338         var i int
339         if psl == nil {
340                 i = strings.LastIndex(host, ".")
341                 if i == -1 {
342                         return host
343                 }
344         } else {
345                 suffix := psl.PublicSuffix(host)
346                 if suffix == host {
347                         return host
348                 }
349                 i = len(host) - len(suffix)
350                 if i <= 0 || host[i-1] != '.' {
351                         // The provided public suffix list psl is broken.
352                         // Storing cookies under host is a safe stopgap.
353                         return host
354                 }
355         }
356         prevDot := strings.LastIndex(host[:i-1], ".")
357         return host[prevDot+1:]
358 }
@bradfitz bradfitz changed the title http.CookieJar does not safely create keys from hosts net/http/cookiejar: CookieJar does not safely create keys from hosts Mar 3, 2017
@bradfitz bradfitz added help wanted NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one. labels Mar 3, 2017
@bradfitz bradfitz added this to the Go1.9 milestone Mar 3, 2017
@bradfitz
Copy link
Contributor

bradfitz commented Mar 3, 2017

/cc @vdobler @nigeltao

@vdobler
Copy link
Contributor

vdobler commented Mar 5, 2017

@xeoncross which public suffix list did you use? A nil one?
Can you reveal the domain name which triggered the problem?

@vdobler
Copy link
Contributor

vdobler commented Mar 6, 2017

Reproducible with a domain name of "..".

@gopherbot
Copy link

CL https://golang.org/cl/37843 mentions this issue.

@golang golang locked and limited conversation to collaborators Mar 21, 2018
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
FrozenDueToAge help wanted NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one.
Projects
None yet
Milestone
Go1.9
Development

No branches or pull requests
4 participants
@bradfitz @xeoncross @vdobler @gopherbot