cookie_util.cc incorrectly handles date parsing failures |
||
Issue descriptionhttps://code.google.com/p/chromium/codesearch#chromium/src/net/cookies/cookie_util.cc&l=204 // If our values are within their correct ranges, we got our time. if (exploded.day_of_month >= 1 && exploded.day_of_month <= 31 && exploded.month >= 1 && exploded.month <= 12 && exploded.year >= 1601 && exploded.year <= 30827 && exploded.hour <= 23 && exploded.minute <= 59 && exploded.second <= 59) { return base::Time::FromUTCExploded(exploded); } This range check is insufficient to guarantee that FromUTCExploded will succeed. Possible to end up with a bogus time for the cookie.
,
Apr 13 2016
According to the Internet mktime allows some invalid times, at least - subtract 100 from month, for example, to get a time 100 months previous. Seems like that adding 2 to a day, like Feb. 28, could do the same.
,
Apr 13 2016
Maybe go from exploded to Time and then back, and compare the values?
,
Apr 14 2016
That is true of mktime, but not generally true of base::Time::FromUTCExploded(). Since under the hood the Windows implementation accepts a very different set of values, and out of range days/months don't have that same semantic meaning. This is a problem with our FromUTCExploded() API as described in the parent bug. It is unpredictable with how it will handle different values (what it considers failures), and is also inconsistent in how it reports "errors". As a first approximation the various exploded checks here could be replaced by exploded.HasValidValues(). (1601 for instance is the Windows epoch in there, and 1970 is the minimum year the posix one supports.) Round-tripping would be a good workaround as you mention.
,
Jun 30 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/3d0a1b68b407f0535052b62819f9e7bb68ee2a94 commit 3d0a1b68b407f0535052b62819f9e7bb68ee2a94 Author: maksim.sisov <maksim.sisov@intel.com> Date: Thu Jun 30 09:59:36 2016 Make callers of FromUTC(Local)Exploded in third_party/ use new time API. Use new time conversion API in accordance with https://codereview.chromium.org/1988663002/ BUG= 601905 Review-Url: https://codereview.chromium.org/2091673002 Cr-Commit-Position: refs/heads/master@{#403134} [modify] https://crrev.com/3d0a1b68b407f0535052b62819f9e7bb68ee2a94/third_party/zlib/google/zip_reader.cc [modify] https://crrev.com/3d0a1b68b407f0535052b62819f9e7bb68ee2a94/third_party/zlib/google/zip_unittest.cc
,
Jul 4 2016
Comment 5 is wrong. I used wrong bug number by accident. Comment 5 issue concerns https://bugs.chromium.org/p/chromium/issues/detail?id=601908
,
Dec 20 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/c8c6cd130d570c7b269e6c10e6716631afd3a648 commit c8c6cd130d570c7b269e6c10e6716631afd3a648 Author: maksim.sisov <maksim.sisov@intel.com> Date: Tue Dec 20 13:36:00 2016 Make callers of FromUTC(Local)Exploded in net/ use new time API. Use new time conversion API in accordance with https://codereview.chromium.org/1988663002/ BUG= 601905 , 601903 , 601900 Review-Url: https://codereview.chromium.org/2090713003 Cr-Commit-Position: refs/heads/master@{#439789} [modify] https://crrev.com/c8c6cd130d570c7b269e6c10e6716631afd3a648/net/cert/ct_policy_enforcer_unittest.cc [modify] https://crrev.com/c8c6cd130d570c7b269e6c10e6716631afd3a648/net/cert/x509_cert_types.cc [modify] https://crrev.com/c8c6cd130d570c7b269e6c10e6716631afd3a648/net/cert/x509_cert_types_unittest.cc [modify] https://crrev.com/c8c6cd130d570c7b269e6c10e6716631afd3a648/net/disk_cache/blockfile/eviction.cc [modify] https://crrev.com/c8c6cd130d570c7b269e6c10e6716631afd3a648/net/extras/sqlite/sqlite_channel_id_store_unittest.cc [modify] https://crrev.com/c8c6cd130d570c7b269e6c10e6716631afd3a648/net/ftp/ftp_directory_listing_parser_ls.cc [modify] https://crrev.com/c8c6cd130d570c7b269e6c10e6716631afd3a648/net/ftp/ftp_directory_listing_parser_unittest.cc [modify] https://crrev.com/c8c6cd130d570c7b269e6c10e6716631afd3a648/net/ftp/ftp_directory_listing_parser_unittest.h [modify] https://crrev.com/c8c6cd130d570c7b269e6c10e6716631afd3a648/net/ftp/ftp_directory_listing_parser_vms.cc [modify] https://crrev.com/c8c6cd130d570c7b269e6c10e6716631afd3a648/net/ftp/ftp_util.cc [modify] https://crrev.com/c8c6cd130d570c7b269e6c10e6716631afd3a648/net/http/http_util_unittest.cc
,
Dec 21 2016
I guess we can close it now.
,
Dec 21 2016
|
||
►
Sign in to add a comment |
||
Comment 1 by eroman@chromium.org
, Apr 8 2016