Fix NPE on invalid cookie, close AsyncHttpClient#1512

slandelle · slandelle · commit 22211e543e85 · 2018-02-07T14:12:58.000+01:00
Motivation:

Cookie could be null if the Set-Cookie header is malformed or invalid.
We need to protect against those.

Then, we’re always using the strict decoder without honoring the config
property.

Modifications:

* protect against null cookies
* honor `useLaxCookieEncoder` config

Result:

No more NPE on invalid cookies
diff --git a/client/src/main/java/org/asynchttpclient/netty/handler/intercept/Interceptors.java b/client/src/main/java/org/asynchttpclient/netty/handler/intercept/Interceptors.java
@@ -40,6 +40,7 @@ public class Interceptors {
   private final ConnectSuccessInterceptor connectSuccessInterceptor;
   private final ResponseFiltersInterceptor responseFiltersInterceptor;
   private final boolean hasResponseFilters;
+  private final ClientCookieDecoder cookieDecoder;
 
   public Interceptors(AsyncHttpClientConfig config,
                       ChannelManager channelManager,
@@ -52,6 +53,7 @@ public Interceptors(AsyncHttpClientConfig config,
     connectSuccessInterceptor = new ConnectSuccessInterceptor(channelManager, requestSender);
     responseFiltersInterceptor = new ResponseFiltersInterceptor(config, requestSender);
     hasResponseFilters = !config.getResponseFilters().isEmpty();
+    cookieDecoder = config.isUseLaxCookieEncoder() ? ClientCookieDecoder.LAX : ClientCookieDecoder.STRICT;
   }
 
   public boolean exitAfterIntercept(Channel channel,
@@ -71,8 +73,11 @@ public boolean exitAfterIntercept(Channel channel,
     CookieStore cookieStore = config.getCookieStore();
     if (cookieStore != null) {
       for (String cookieStr : responseHeaders.getAll(SET_COOKIE)) {
-        Cookie c = ClientCookieDecoder.STRICT.decode(cookieStr);
-        cookieStore.add(future.getCurrentRequest().getUri(), c);
+        Cookie c = cookieDecoder.decode(cookieStr);
+        if (c != null) {
+          // Set-Cookie header could be invalid/malformed
+          cookieStore.add(future.getCurrentRequest().getUri(), c);
+        }
       }
     }
 
