GNU bug report logs - #16960
24.3.50; Infinite loop in url-retrieve-synchronously if method is POST and response status is 301/302

Please note: This is a static page, with minimal formatting, updated once a day.
Click here to see this page with the latest information and nicer formatting.

Package: emacs; Reported by: Alex Kost <alezost@HIDDEN>; merged with #21017; dated Fri, 7 Mar 2014 15:26:02 UTC; Maintainer for emacs is bug-gnu-emacs@HIDDEN.

Message received at 16960 <at> debbugs.gnu.org:


Received: (at 16960) by debbugs.gnu.org; 25 Dec 2015 20:36:56 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Fri Dec 25 15:36:56 2015
Received: from localhost ([127.0.0.1]:35462 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1aCZ6e-0004NS-D6
	for submit <at> debbugs.gnu.org; Fri, 25 Dec 2015 15:36:56 -0500
Received: from hermes.netfonds.no ([80.91.224.195]:48836)
 by debbugs.gnu.org with esmtp (Exim 4.84)
 (envelope-from <larsi@HIDDEN>) id 1aCZ6c-0004NJ-Cs
 for 16960 <at> debbugs.gnu.org; Fri, 25 Dec 2015 15:36:54 -0500
Received: from 2.150.58.24.tmi.telenormobil.no ([2.150.58.24] helo=mouse)
 by hermes.netfonds.no with esmtpsa (TLS1.0:RSA_AES_128_CBC_SHA1:16)
 (Exim 4.72) (envelope-from <larsi@HIDDEN>)
 id 1aCZ6H-00044d-5d; Fri, 25 Dec 2015 21:36:33 +0100
From: Lars Ingebrigtsen <larsi@HIDDEN>
To: Alex Kost <alezost@HIDDEN>
Subject: Re: bug#16960: 24.3.50;
 Infinite loop in url-retrieve-synchronously if method is POST and
 response status is 301/302
References: <878usmni8l.fsf@HIDDEN>
Date: Fri, 25 Dec 2015 21:36:32 +0100
In-Reply-To: <878usmni8l.fsf@HIDDEN> (Alex Kost's message of "Fri, 07 Mar
 2014 19:25:30 +0400")
Message-ID: <87k2o22rlb.fsf@HIDDEN>
User-Agent: Gnus/5.130014 (Ma Gnus v0.14) Emacs/25.1.50 (gnu/linux)
MIME-Version: 1.0
Content-Type: text/plain
X-MailScanner-ID: 1aCZ6H-00044d-5d
X-Netfonds-MailScanner: Found to be clean
X-Netfonds-MailScanner-From: larsi@HIDDEN
MailScanner-NULL-Check: 1451680593.43088@qAKKjM3SRwwfOjXXgRuoMA
X-Spam-Status: No
X-Spam-Score: -0.7 (/)
X-Debbugs-Envelope-To: 16960
Cc: 16960 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -0.7 (/)

Alex Kost <alezost@HIDDEN> writes:

> The problem is the following: when I try to login to
> https://aur.archlinux.org with `url-retrieve-synchronously' (see the
> code below), Emacs freezes (C-g helps) because callback passed to
> `url-retrieve' is never called.
>
> AFAIU this happens because `url-http-parse-headers' returns nil if
> response status is 301/302/307 and method is not "HEAD" or "GET" (see
> <http://git.savannah.gnu.org/cgit/emacs.git/tree/lisp/url/url-http.el#n574>).
> At least the problem goes away when I add:
>
>   (setq success t)
>
> after
>
>   (or `moved-permanently `found `temporary-redirect)
>
> in `url-http-parse-headers'.
>
> Would it be OK to allow such requests?
>
> Recipe is simple but you need to have an account on
> <https://aur.archlinux.org> for that:

I don't have an account there, so I can't reproduce this bug.  But could
you create a patch that fixes this problem?

-- 
(domestic pets only, the antidote for overdose, milk.)
   bloggy blog: http://lars.ingebrigtsen.no




Information forwarded to bug-gnu-emacs@HIDDEN:
bug#16960; Package emacs. Full text available.
Merged 16960 21017. Request was from Glenn Morris <rgm@HIDDEN> to control <at> debbugs.gnu.org. Full text available.

Message received at submit <at> debbugs.gnu.org:


Received: (at submit) by debbugs.gnu.org; 7 Mar 2014 15:25:58 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Fri Mar 07 10:25:58 2014
Received: from localhost ([127.0.0.1]:55029 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.80)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1WLwes-0001RU-0Y
	for submit <at> debbugs.gnu.org; Fri, 07 Mar 2014 10:25:58 -0500
Received: from eggs.gnu.org ([208.118.235.92]:47642)
 by debbugs.gnu.org with esmtp (Exim 4.80)
 (envelope-from <alezost@HIDDEN>) id 1WLwep-0001RM-8y
 for submit <at> debbugs.gnu.org; Fri, 07 Mar 2014 10:25:55 -0500
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
 (envelope-from <alezost@HIDDEN>) id 1WLwek-0008Mg-LN
 for submit <at> debbugs.gnu.org; Fri, 07 Mar 2014 10:25:54 -0500
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on eggs.gnu.org
X-Spam-Level: 
X-Spam-Status: No, score=0.0 required=5.0 tests=BAYES_20,FREEMAIL_FROM,
 T_DKIM_INVALID autolearn=disabled version=3.3.2
Received: from lists.gnu.org ([2001:4830:134:3::11]:58335)
 by eggs.gnu.org with esmtp (Exim 4.71)
 (envelope-from <alezost@HIDDEN>) id 1WLwek-0008MM-J8
 for submit <at> debbugs.gnu.org; Fri, 07 Mar 2014 10:25:50 -0500
Received: from eggs.gnu.org ([2001:4830:134:3::10]:49340)
 by lists.gnu.org with esmtp (Exim 4.71)
 (envelope-from <alezost@HIDDEN>) id 1WLweg-0006EE-89
 for bug-gnu-emacs@HIDDEN; Fri, 07 Mar 2014 10:25:50 -0500
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
 (envelope-from <alezost@HIDDEN>) id 1WLweb-0008LH-V1
 for bug-gnu-emacs@HIDDEN; Fri, 07 Mar 2014 10:25:46 -0500
Received: from mail-la0-x22a.google.com ([2a00:1450:4010:c03::22a]:62162)
 by eggs.gnu.org with esmtp (Exim 4.71)
 (envelope-from <alezost@HIDDEN>) id 1WLweb-0008L2-L6
 for bug-gnu-emacs@HIDDEN; Fri, 07 Mar 2014 10:25:41 -0500
Received: by mail-la0-f42.google.com with SMTP id ec20so2934786lab.1
 for <bug-gnu-emacs@HIDDEN>; Fri, 07 Mar 2014 07:25:39 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113;
 h=from:to:subject:date:message-id:mime-version:content-type;
 bh=3wwozrUPyyhRdJQVtD+FGLOUWNxkthn7RkV20YHPySA=;
 b=CEHt7aG85ToEQwJybL3C2m7t4ZP7rqL24eDFYX0laz/w1mMfVowufXZx4vMclh0cei
 Cpw5fqnN1asAlQCiadx6yfCcJ9A9AUKlHtfPMsgACiK8s5X4ZUmRA2DmpLSrKM/3G3HY
 O3lyleMHzmQA+mNswaaihIyF4J5TnW4glXKlka3HBe0uxI1lcSk9R0xMy1jmAj555FjA
 ovOL7MGGUQmLSvxv4AeOH+eEE3AcOTcO7MJPC0p6lB66V6YgEJTggwf/w2Y2i5kkOwog
 kyg7XpLblQk4T+BzfL7vTMtU4q/ztH+xivfPDXc+dUpx7jXDYoYc5chH+ucLCyipHCtr
 McxQ==
X-Received: by 10.112.136.71 with SMTP id py7mr8256512lbb.26.1394205939623;
 Fri, 07 Mar 2014 07:25:39 -0800 (PST)
Received: from leviafan (128-70-206-28.broadband.corbina.ru. [128.70.206.28])
 by mx.google.com with ESMTPSA id
 wv4sm1297441lbb.10.2014.03.07.07.25.37 for <bug-gnu-emacs@HIDDEN>
 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
 Fri, 07 Mar 2014 07:25:37 -0800 (PST)
From: Alex Kost <alezost@HIDDEN>
To: bug-gnu-emacs@HIDDEN
Subject: 24.3.50;
 Infinite loop in url-retrieve-synchronously if method is POST and
 response status is 301/302
Date: Fri, 07 Mar 2014 19:25:30 +0400
Message-ID: <878usmni8l.fsf@HIDDEN>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="=-=-="
X-detected-operating-system: by eggs.gnu.org: Error: Malformed IPv6 address
 (bad octet value).
X-detected-operating-system: by eggs.gnu.org: Error: Malformed IPv6 address
 (bad octet value).
X-Received-From: 2001:4830:134:3::11
X-Spam-Score: -4.0 (----)
X-Debbugs-Envelope-To: submit
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <http://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <http://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <http://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -4.0 (----)

--=-=-=
Content-Type: text/plain

The problem is the following: when I try to login to
https://aur.archlinux.org with `url-retrieve-synchronously' (see the
code below), Emacs freezes (C-g helps) because callback passed to
`url-retrieve' is never called.

AFAIU this happens because `url-http-parse-headers' returns nil if
response status is 301/302/307 and method is not "HEAD" or "GET" (see
<http://git.savannah.gnu.org/cgit/emacs.git/tree/lisp/url/url-http.el#n574>).
At least the problem goes away when I add:

  (setq success t)

after

  (or `moved-permanently `found `temporary-redirect)

in `url-http-parse-headers'.

Would it be OK to allow such requests?

Recipe is simple but you need to have an account on
<https://aur.archlinux.org> for that:

1. emacs -Q
2. Evaluate (setq url-debug t)
3. Evaluate the following code:


--=-=-=
Content-Type: application/emacs-lisp
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

(defun url-post (url args &optional inhibit-cookies)
  "Send ARGS to URL as a POST request.
ARGS is alist of field names and values to send.
Return the buffer with the received data.
If INHIBIT-COOKIES is non-nil, do not use saved cookies."
  (let ((url-request-method "POST")
        (url-request-extra-headers
         '(("Content-Type" . "application/x-www-form-urlencoded")))
        (url-request-data
         (mapconcat (lambda (arg)
                      (concat (url-hexify-string (car arg))
                              "=3D"
                              (url-hexify-string (cdr arg))))
                    args
                    "&")))
    (url-retrieve-synchronously url inhibit-cookies)))

(url-post
 "https://aur.archlinux.org/login"
 (list (cons "user" "<REAL-USER-NAME>")
       (cons "passwd" "<REAL-PASSWORD>")
       (cons "remember_me" "off"))
 t)

--=-=-=
Content-Type: text/plain


3. Emacs hangs; press C-g
4. In "*URL-DEBUG*" buffer you can see the line:

  http -> Finished parsing HTTP headers: nil


In GNU Emacs 24.3.50.2 (i686-pc-linux-gnu, GTK+ Version 3.10.6)
 of 2014-02-02 on leviafan
Windowing system distributor `The X.Org Foundation', version 11.0.11500000
Configured using:
 `configure --prefix=/home/alexx/usr'

--=-=-=--




Acknowledgement sent to Alex Kost <alezost@HIDDEN>:
New bug report received and forwarded. Copy sent to bug-gnu-emacs@HIDDEN. Full text available.
Report forwarded to bug-gnu-emacs@HIDDEN:
bug#16960; Package emacs. Full text available.
Please note: This is a static page, with minimal formatting, updated once a day.
Click here to see this page with the latest information and nicer formatting.
Last modified: Mon, 25 Nov 2019 12:00:02 UTC

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997 nCipher Corporation Ltd, 1994-97 Ian Jackson.