Request to backport 6644726

[Dr Andrew John Hughes]

On 11:35 Fri 11 Feb     , Joe Darcy wrote:
> Networking team,
> 
> Any comments on backporting this change to OpenJDK 6?  My inclination is 
> to approve the backport, but I want your input on the issue.
> 
> -Joe
> 
> On 2/8/2011 1:19 AM, Florian Weimer wrote:
> > This change:
> >
> > # User jccollet
> > # Date 1208423133 -7200
> > # Node ID d44e3bf49ffbcbc5c6ce9a8fa4113153f8368a60
> > # Parent  a954a6f3be6fa69014f00488f52b2da12e6634bf
> > 6644726: Cookie management issues
> > Summary: Many changes to accomodate RFC 2965 and old Netscape specs
> > Reviewed-by: chegar
> >
> > diff -r a954a6f3be6f -r d44e3bf49ffb src/share/classes/java/net/CookieManager.java
> > --- a/src/share/classes/java/net/CookieManager.java     Wed Apr 16 14:17:54 2008 +0100
> > +++ b/src/share/classes/java/net/CookieManager.java     Thu Apr 17 11:05:33 2008 +0200
> > @@ -205,11 +205,31 @@
> >           if (cookieJar == null)
> >               return Collections.unmodifiableMap(cookieMap);
> >
> > +        boolean secureLink = "https".equalsIgnoreCase(uri.getScheme());
> >           List<HttpCookie>  cookies = new java.util.ArrayList<HttpCookie>();
> > +        String path = uri.getPath();
> > +        if (path == null || path.isEmpty()) {
> > +            path = "/";
> > +        }
> >           for (HttpCookie cookie : cookieJar.get(uri)) {
> >               // apply path-matches rule (RFC 2965 sec. 3.3.4)
> > -            if (pathMatches(uri.getPath(), cookie.getPath())) {
> > -                cookies.add(cookie);
> > +            // and check for the possible "secure" tag (i.e. don't send
> > +            // 'secure' cookies over unsecure links)
> > +            if (pathMatches(path, cookie.getPath())&&
> > +                    (secureLink || !cookie.getSecure())) {
> > [...]
> >
> > is arguably a security fix (sending HTTPS-only cookies over HTTP is a
> > problem).  The whole patch seems to be quite important for
> > interoperability.  (Further changes from JDK 7 and maybe even new
> > development may be required to get cookie support working; I will
> > check that if backporting such changes is fine in principle.)
> >
> 

This is only a fragment of 6644726.  Please only use the existing bug ID
if the whole patch is going to be backported.
-- 
Andrew :)

Free Java Software Engineer
Red Hat, Inc. (http://www.redhat.com)

Support Free Java!
Contribute to GNU Classpath and IcedTea
http://www.gnu.org/software/classpath
http://icedtea.classpath.org
PGP Key: F5862A37 (https://keys.indymedia.org/)
Fingerprint = EA30 D855 D50F 90CD F54D  0698 0713 C3ED F586 2A37