mod-security-users

[mod-security-users] Invalid cookie format error, why?

[Aditya <ad...@gr...>]

With:

   SecFilterCheckCookieFormat On

we are seeing the following error:

 Cookie: DYN_CAL='fdow':null,'history':"2005/02/21/19/23",'hsize':9
 mod_security-message: Invalid cookie format: Cookie value is missing #1
 mod_security-action: 500

However, looking at the module code, it seems like the "=" isn't being
matched, but I can't really tell why:

  p = header_copy;
    while(*p != 0) {
        attr_name = NULL;
        attr_value = NULL;

        /* attribute name */
        while(isspace(*p)) p++;
        attr_name = p;
        while((*p != 0)&&(*p != '=')) p++;

        if (*p == 0) {
            /* we've reached the end of the string,
             * and the attribute value is missing
             */
            *error_msg = ap_psprintf(r->pool, "Cookie value is missing #1");
            return -1;
        }

Any hints?

Thanks,
Adi

Re: [mod-security-users] Invalid cookie format error, why?

[Ivan R. <iv...@we...>]

Aditya wrote:
> With:
> 
>    SecFilterCheckCookieFormat On
> 
> we are seeing the following error:
> 
>  Cookie: DYN_CAL='fdow':null,'history':"2005/02/21/19/23",'hsize':9
>  mod_security-message: Invalid cookie format: Cookie value is missing #1
>  mod_security-action: 500
> 
> However, looking at the module code, it seems like the "=" isn't being
> matched, but I can't really tell why:

   Your cookie is in v0 format, while the mod_security 1.8.6 parser
   expects v1 format. I originally thought the 1.8.6 parser will be able
   to handle both but I was mistaken. I realized this recently (when I
   was investigating Stefan's claims, see here

   http://www.modsecurity.org/documentation/known-issues.html

   ) so that's why 1.8.7 now has two cookie parsers. It will correctly
   parse your cookie (I just tried it with 1.8.7RC1).

 >  Cookie: DYN_CAL='fdow':null,'history':"2005/02/21/19/23",'hsize':9
                               ^
   In v1 the comma is used as cookie separator, so the parser was
   expecting two cookies there.

-- 
Ivan Ristic (http://www.modsecurity.org)