Jetty

Cookie causes NumberFormatException

Details

  • Type: Bug Bug
  • Status: Resolved Resolved
  • Priority: Major Major
  • Resolution: Fixed
  • Affects Version/s: 6.1.12rc1
  • Fix Version/s: 7.0.0pre4, 6.1.12.rc2
  • Component/s: HTTP
  • Labels:
    None
  • Environment:
  • Testcase included:
    yes
  • Number of attachments :
    3

Description

Oh Hai,

We're seeing a problem with certain cookie values that are being sent from 3rd parties to our jetty servers. These cookies contain 'unusual' values (e.g. V1z%B%^rQrCCB) but do appear to be valid according to the spec. However jetty attempts to decode the cookie value and blows up with a NumberFormatException, which kills the users' session / prevents any further processing (and makes us sad):

java.lang.NumberFormatException: B%
at org.mortbay.util.TypeUtil.parseInt(TypeUtil.java:345)
at org.mortbay.util.URIUtil.decodePath(URIUtil.java:197)
at org.mortbay.jetty.Request.getCookies(Request.java:481)

Attached is a simple junit test case detailing the issue.

Interestingly the previous line in Request.java (line 480) shows the following:
// TODO remove this old style jetty cookie support (encoding)

Any help would be greatly appreciated,

Thanks & Regards,

Gus.

  1. Text File
    jetty-688.patch
    19/Aug/08 5:19 AM
    2 kB
    David Yu
  2. Text File
    jetty7-688.patch
    27/Aug/08 9:19 PM
    4 kB
    David Yu
  3. Java Source File
    JettyCookieTest.java
    18/Aug/08 5:27 AM
    0.2 kB
    Gus Power

Activity

Ascending order - Click to sort in descending order
Hide
Permalink
Gus Power added a comment -

Interestingly enough we're seeing this with 6.1.12rc1 but we can't reproduce it on 6.1.4.

Show
Gus Power added a comment - Interestingly enough we're seeing this with 6.1.12rc1 but we can't reproduce it on 6.1.4.
Hide
Permalink
Chris Pitts added a comment -

I have narrowed this down further. The issue was introduced between version 6.1.7 and 6.1.8.

Possibly related to the JETTY-498 fix?

Cheers.

Chris
(working with Gus)

Show
Chris Pitts added a comment - I have narrowed this down further. The issue was introduced between version 6.1.7 and 6.1.8. Possibly related to the JETTY-498 fix? Cheers. Chris (working with Gus)
Hide
Permalink
David Yu added a comment -

Is this cookie value (V1z%B%^rQrCCB) passed from URL rewrite?
e.g. http://acme.com/foo.jsp;jsessionid=V1z%B%^rQrCCB

Cheers,
dyu

Show
David Yu added a comment - Is this cookie value (V1z%B%^rQrCCB) passed from URL rewrite? e.g. http://acme.com/foo.jsp;jsessionid=V1z%B% ^rQrCCB Cheers, dyu
Hide
Permalink
Chris Pitts added a comment -

No. It's simply a cookie set by a third party app.

Show
Chris Pitts added a comment - No. It's simply a cookie set by a third party app.
Hide
Permalink
Chris Pitts added a comment -

Sorry, hit return too soon.

Try this:

Unpack and run Jetty.
Go to the root page. Should be fine.
Using something like the Web Developer plugin in Firefox, add a cookie with the test string (or try %b%b - that'll do it)
Refresh the page. Should go bang.

Show
Chris Pitts added a comment - Sorry, hit return too soon. Try this: Unpack and run Jetty. Go to the root page. Should be fine. Using something like the Web Developer plugin in Firefox, add a cookie with the test string (or try %b%b - that'll do it) Refresh the page. Should go bang.
Hide
Permalink
David Yu added a comment -

patch attached for jetty6.
Let me know if that works for you.

Thanks,
dyu

Show
David Yu added a comment - patch attached for jetty6. Let me know if that works for you. Thanks, dyu
Hide
Permalink
Chris Pitts added a comment -

Initial results are good - it seems to have fixed the problem.

Can we leave this open for a bit while our customers give it a damned good thrashing? Thanks

Show
Chris Pitts added a comment - Initial results are good - it seems to have fixed the problem. Can we leave this open for a bit while our customers give it a damned good thrashing? Thanks
Hide
Permalink
David Yu added a comment -

Thanks for the feedback.
You could always re-open an issue if you encounter further problems that are related.
I'll leave this open for now.

Cheers

Show
David Yu added a comment - Thanks for the feedback. You could always re-open an issue if you encounter further problems that are related. I'll leave this open for now. Cheers
Hide
Permalink
Chris Pitts added a comment -

I think we can safely close this issue down. Many thanks for your help.

Show
Chris Pitts added a comment - I think we can safely close this issue down. Many thanks for your help.
Hide
Permalink
David Yu added a comment -

Patch applied. Thanks

Show
David Yu added a comment - Patch applied. Thanks
Hide
Permalink
Jan Bartel added a comment -

dyu,

should this patch also be applied to jetty-7?

Jan

Show
Jan Bartel added a comment - dyu, should this patch also be applied to jetty-7? Jan
Hide
Permalink
David Yu added a comment -

janb,

Not the same patch was applied to jetty7 .. it was jetty7-688.patch (attached).

Cheers

Show
David Yu added a comment - janb, Not the same patch was applied to jetty7 .. it was jetty7-688.patch (attached). Cheers

People

  • Assignee:
    David Yu
    Reporter:
    Gus Power
Vote (1)
Watch (1)

Dates

  • Created:
    Updated:
    Resolved: