net/http/cookiejar: CookieJar does not safely create keys from hosts

[xeoncross]

What version of Go are you using (go version)?

go version go1.7.4 darwin/amd64

What operating system and processor architecture are you using (go env)?

GOARCH="amd64"
GOBIN="/Users/user/go//bin"
GOEXE=""
GOHOSTARCH="amd64"
GOHOSTOS="darwin"
GOOS="darwin"
GOPATH="/Users/user/go/"
GORACE=""
GOROOT="/usr/local/Cellar/go/1.7.4/libexec"
GOTOOLDIR="/usr/local/Cellar/go/1.7.4/libexec/pkg/tool/darwin_amd64"
CC="clang"
GOGCCFLAGS="-fPIC -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=/var/folders/n0/7jgcgsvs15q4r63w4z0nrpbr0000gp/T/go-build841391109=/tmp/go-build -gno-record-gcc-switches -fno-common"
CXX="clang++"
CGO_ENABLED="1"

What did you do?

Using http.CookieJar with http.Client and github.com/viki-org/dnscache I have had some failed DNS lookups which reveled a bug in jarKey() when an invalid host string is given. Unfortunately I am having trouble re-creating this issue from the application.

What did you expect to see?

Nothing

What did you see instead?

panic: runtime error: slice bounds out of range

goroutine 85 [running]:
panic(0x43110e0, 0xc42000c110)
	/usr/local/Cellar/go/1.7.4/libexec/src/runtime/panic.go:500 +0x1a1
net/http/cookiejar.jarKey(0xc4201593d7, 0x1, 0x0, 0x0, 0x0, 0x0)
	/usr/local/Cellar/go/1.7.4/libexec/src/net/http/cookiejar/jar.go:356 +0x145
net/http/cookiejar.(*Jar).cookies(0xc42021a030, 0xc42008f200, 0xed04bcaa3, 0x28ab5878, 0x46057a0, 0x0, 0x0, 0x0)
	/usr/local/Cellar/go/1.7.4/libexec/src/net/http/cookiejar/jar.go:184 +0x154
net/http/cookiejar.(*Jar).Cookies(0xc42021a030, 0xc42008f200, 0x0, 0x0, 0x1)
	/usr/local/Cellar/go/1.7.4/libexec/src/net/http/cookiejar/jar.go:172 +0x55
net/http.(*Client).send(0x45e3780, 0xc4200cec30, 0xed04bcac1, 0x28ab5562, 0x46057a0, 0xc42002a478, 0x0, 0x1)
	/usr/local/Cellar/go/1.7.4/libexec/src/net/http/client.go:142 +0x4e
net/http.(*Client).doFollowingRedirects(0x45e3780, 0xc4200cec30, 0x43a69d0, 0x3, 0x40b8001, 0xc4202c24d8)
	/usr/local/Cellar/go/1.7.4/libexec/src/net/http/client.go:528 +0x5e5
net/http.(*Client).Do(0x45e3780, 0xc4200cec30, 0xa, 0x438b234, 0x79)
	/usr/local/Cellar/go/1.7.4/libexec/src/net/http/client.go:184 +0x1ea
app/httpclient.GetRequest(0xc4201593d0, 0x9, 0x7d000, 0xc42015d1a0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ...)
	/Users/user/go/src/app/httpclient/httpclient.go:141 +0x1c7
exit status 2


The last line of my code is 

  141: 	resp, err := client.Do(req)

For my current Go 1.7 source here is the line 356:

332 // jarKey returns the key to use for a jar.
333 func jarKey(host string, psl PublicSuffixList) string {
334         if isIP(host) {
335                 return host
336         }
337 
338         var i int
339         if psl == nil {
340                 i = strings.LastIndex(host, ".")
341                 if i == -1 {
342                         return host
343                 }
344         } else {
345                 suffix := psl.PublicSuffix(host)
346                 if suffix == host {
347                         return host
348                 }
349                 i = len(host) - len(suffix)
350                 if i <= 0 || host[i-1] != '.' {
351                         // The provided public suffix list psl is broken.
352                         // Storing cookies under host is a safe stopgap.
353                         return host
354                 }
355         }
356         prevDot := strings.LastIndex(host[:i-1], ".")
357         return host[prevDot+1:]
358 }

[bradfitz]

/cc @vdobler @nigeltao

[vdobler]

@xeoncross which public suffix list did you use? A nil one?
Can you reveal the domain name which triggered the problem?

[vdobler]

Reproducible with a domain name of "..".

[gopherbot]

CL https://golang.org/cl/37843 mentions this issue.