Regression: Firefox 3.6.18 does not set cookie when talking to single letter hostname

[Etienne Goyer]

When talking to an hostname consisting of a single letter, Firefox 3.6.18 does not set cookie. Previous version did fine, as well as other browser such as chromium.

How to reproduce:

sudo apt-get install lighttpd
sudo lighttpd-enable-mod cgi
sudo vim /etc/hosts

make 'a' go to 127.0.0.1 as in:

root@machine:/var/www# head -n1 /etc/hosts
127.0.0.1 localhost a

Then simply install the attached python cgi and go to it in
firefox-3.6.18. In our tests it never set a cookie. When testing with
Chrome, it sets the cookie fine.

root@machine:/var/www# lsb_release -rd
Description: Ubuntu 10.04.2 LTS
Release: 10.04

root@machine:/var/www# apt-cache policy firefox
firefox:
 Installed: 3.6.18+build2+nobinonly-0ubuntu0.10.04.1
 Candidate: 3.6.18+build2+nobinonly-0ubuntu0.10.04.1
 Version table:

I expected my cgi script to print something like:
The returned cookie string was "foo=1308946645.14"

and not:

First visit or cookies disabled.

[Chris Coulson (chrisccoulson)]

I'm reporting this from https://bugs.launchpad.net/ubuntu/+source/firefox/+bug/801778

Since Firefox 3.6.18, cookies cannot be stored with single character hostnames. This is reproducible by installing the extension developer addon and doing this in the JS shell:

cm = Cc["@mozilla.org/cookiemanager;1"].getService(Ci.nsICookieManager2);
expiry = (Date.now() + 1000) * 1000;
cm.countCookiesFromHost("a"); /* Should be 0 */
cm.add("a", "/", "foo", "bar", false, false, true, expiry);
cm.countCookiesFromHost("a"); /* Is still 0, but should now be 1 */

This wasn't a problem in 3.6.17. It doesn't seem to be a problem on current nightlies or aurora either (I didn't test 5.0)

I see there's a couple of suspect commits between 3.6.17 and 3.6.18, but I'm still waiting for my mozilla-1.9.2 tree to build before I can actually verify that:

http://hg.mozilla.org/releases/mozilla-1.9.2/rev/bb935ffe5ff1
http://hg.mozilla.org/releases/mozilla-1.9.2/rev/bb728fdcd717

[Chris Coulson (chrisccoulson)]

Not an issue in 5.0

[Chris Coulson (chrisccoulson)]

It's definitely this one which breaks it: http://hg.mozilla.org/releases/mozilla-1.9.2/rev/bb935ffe5ff1

When running the first iteration of the loop in nsCookieService::CountCookiesFromHostInt, (nextDot <= end && *(nextDot + 1) == '\0') always evaluates to true, so it just bails out

[Chris Coulson (chrisccoulson)]

Created attachment 542125
Fix bug 667087.patch

Here is a patch which fixes this, with test-case. I'm not sure if it's the best way to fix this without understanding what http://hg.mozilla.org/releases/mozilla-1.9.2/rev/bb728fdcd717 is for.

[Chris Coulson (chrisccoulson)]

Created attachment 542128
Test for mozilla-central

[Dveditz (dveditz)]

apparently not a problem on trunk, where we took a different patch for bug 616264

[Dwitte (dwitte)]

Comment on attachment 542125
Fix bug 667087.patch

Looks great to me. Nice fix! r=dwitte

[Dwitte (dwitte)]

Comment on attachment 542128
Test for mozilla-central

r=dwitte

[Ehsan-mozilla (ehsan-mozilla)]

The ubuntu folks want this badly. Can we get the approval on this one soon, please?

[Ehsan-mozilla (ehsan-mozilla)]

I landed the m-c test on inbound. Please do not mark the bug as FIXED when you merge to central.

[Clegnitto (clegnitto)]

Comment on attachment 542125
Fix bug 667087.patch

Approved for 1.9.2.19

[Micah Gersten (micahg)]

Chris's patch has been accepted upstream, I'll get the updates built and tested. Upstream has requested we wait to release the fix until the patch actually lands on the 1.9.2 branch before releasing to make sure that the unit tests pass.

[Mak77 (mak77)]

test merged http://hg.mozilla.org/mozilla-central/rev/beadf61d53a7

[Ehsan-mozilla (ehsan-mozilla)]

http://hg.mozilla.org/releases/mozilla-1.9.2/rev/2b1eb891d7fe

[Launchpad Janitor (janitor)]

This bug was fixed in the package firefox - 3.6.18+build2+nobinonly-0ubuntu0.10.04.2

---------------
firefox (3.6.18+build2+nobinonly-0ubuntu0.10.04.2) lucid-security; urgency=low

  * fix LP: #801778 - Regression: Firefox 3.6.18 does not set cookie when
    talking to single letter hostname
    - add debian/patches/lp801778_bz667087_att542125-fix-cookie-regression.patch
    - update debian/patches/series
 -- Micah Gersten <email address hidden> Tue, 28 Jun 2011 23:14:35 +0100

[Launchpad Janitor (janitor)]

This bug was fixed in the package firefox - 3.6.18+build2+nobinonly-0ubuntu0.10.10.2

---------------
firefox (3.6.18+build2+nobinonly-0ubuntu0.10.10.2) maverick-security; urgency=low

  * fix LP: #801778 - Regression: Firefox 3.6.18 does not set cookie when
    talking to single letter hostname
    - add debian/patches/lp801778_bz667087_att542125-fix-cookie-regression.patch
    - update debian/patches/series
 -- Micah Gersten <email address hidden> Tue, 28 Jun 2011 23:21:04 +0100

[Abillings (abillings)]

Verified fixed using 1.9.2 testcase for 1.9.2.20.

[Andrei-domuta (andrei-domuta)]

(In reply to comment #12)
> Verified fixed using 1.9.2 testcase for 1.9.2.20.

Changing the resolution to verified.