unicode encoding error in cookie

[Dave Abrahams <dave@…>]

I ran into a situation where the cookie was unicode but the rest of the code expected a str; the following made it go away:

trac/web/api.py

@@ -505 +505 @@
                                                                                                                                                                                                     
         cookies = self.outcookie.output(header='')                                                                                                                                                  
         for cookie in cookies.splitlines():                                                                                                                                                         
-            self._outheaders.append(('Set-Cookie', cookie.strip()))                                                                                                                                 
+            self._outheaders.append(('Set-Cookie', str(cookie.strip())))                                                                                                                            
                                                                                                                                                                                                     
                                                                                                                                                                                                     
 class IAuthenticator(Interface):                                                                                                                                                                    

[Dave Abrahams <dave@…>]

The specific error was:

AssertionError: Header values must be strings

[Christian Boos]

It would probably be worth investigating how a unicode value could get in. Also, str() conversion is not robust in case that unicode value contains anything else than 'ascii' characters, on most systems.

[Dave Abrahams <dave@…>]

Replying to cboos:

It would probably be worth investigating how a unicode value could get in.

Definitely. But I don't know where to start. Frankly I'm not even 100% positive that it was unicode and not, say, an int. If you have specific tests you'd like me to run, I can try to do that.

Also, str() conversion is not robust in case that unicode value contains anything else than 'ascii' characters, on most systems.

I know. Maybe I should be using something from urlencode?

[Christian Boos]

Replying to Dave Abrahams <dave@boost-consulting.com>:

Replying to cboos:

It would probably be worth investigating how a unicode value could get in.

Definitely. But I don't know where to start. Frankly I'm not even 100% positive that it was unicode and not, say, an int. If you have specific tests you'd like me to run, I can try to do that.

Me neither ;-) Add some more debugging info?

Also, str() conversion is not robust in case that unicode value contains anything else than 'ascii' characters, on most systems.

I know. Maybe I should be using something from urlencode?

The brute force way would be to_unicode(...).encode('utf-8').

[ThurnerRupert]

nobody else noticed it … maybe its save to leave it until 0.11.1 … also seems to be no degression.

[Dave Abrahams <dave@…>]

Assertion error screen produced by fastcgi when this patch is needed

[Dave Abrahams <dave@…>]

Correction: Assertion error screen produced by fastcgi when this patch is needed

[Christian Boos]

Can you try this patch?

trac/web/api.py

@@ -122 +122 @@
             self._strict_set(key, real_value, coded_value)
         except CookieError:
             self.bad_cookies.append(key)
-            dict.__setitem__(self, key, None)
+            dict.__setitem__(self, key, '')
 
 
 class Request(object):

[Dave Abrahams <dave@…>]

Replying to cboos:

Can you try this patch?

Seems to work!

[Dave Abrahams <dave@…>]

Replying to Dave Abrahams <dave@boost-consulting.com>:

Replying to cboos:

Can you try this patch?

Seems to work!

I take it back; still broken. See login.html and logout.html

[Dave Abrahams <dave@…>]

more assertion errors

[Dave Abrahams <dave@…>]

still more assertion errors

[Christian Boos]

Well, perhaps could you add some tracing in that Cookie class in order to see what's really going on?

[Dave Abrahams <dave@…>]

Replying to cboos:

Well, perhaps could you add some tracing in that Cookie class in order to see what's really going on?

I'm happy to try specific patches you suggest and let you know the output, but I can't afford to try to figure out what to trace by myself.

[Christian Boos]

Seems this was the same issue as #9176.

In any case, the fix r9409 would work also for this issue.