Subject: #306: does etag value really use quoted-string

From: Mark Nottingham <[email-masked]>
Date: Tue, 26 Jul 2011 15:59:06 -0400

<http://trac.tools.ietf.org/wg/httpbis/trac/ticket/306>

As discussed in the meeting today, ETags are specified as quoted-string, but many implementations do not treat them as such; e.g., they don't handle \-escaping.

Whereas in other places this is a presentation issue, with ETags, this is a more serious interop issue.

Consider a response with:

ETag: "\a"

And a subsequent request:

PUT /foo
If-Match: "a"

Proposal:

Re-specify ETags as a new ABNF construct separate to quoted-string, where \ is not an escape character. By their nature, they cannot contain a double-quote character.

--
Mark Nottingham   http://www.mnot.net/

---

From: Yves Lafon <[email-masked]>
Date: Tue, 26 Jul 2011 17:44:31 -0400 (EDT)

On Tue, 26 Jul 2011, Mark Nottingham wrote:

> As discussed in the meeting today, ETags are specified as quoted-string, 
> but many implementations do not treat them as such; e.g., they don't 
> handle \-escaping.
>

The issue is also:
Are implementations properly implement quoted string in general (and not 
only badly in ETags)?

> Re-specify ETags as a new ABNF construct separate to quoted-string, 
> where \ is not an escape character. By their nature, they cannot contain 
> a double-quote character.

In that case, for implementation already "doing it right", they will fail 
on \" and \\, so forbidding '\' from the ETag production seems safer.

-- 
Baroula que barouleras, au tiéu toujou t'entourneras.

         ~~Yves

---

From: Yves Lafon <[email-masked]>
Date: Wed, 27 Jul 2011 09:22:23 -0400 (EDT)

> but many implementations do not treat them as such; e.g., they don't 

Here are some tests done using INM:

When resource received has ETag: "foo"

Apache 2.2:
INM: "foo"        => 304 OK
INM: "fo\o"       => 200
INM: "foo\"       => 200 OK
INM: "fo\o","foo" => 304 OK
INM: "foo\","foo" => 200 OK

MS IIS 7.5:
INM: "foo"        => 304 OK
INM: "fo\o"       => 200
INM: "foo\"       => 200 OK
INM: "fo\o","foo" => 304 OK
INM: "foo\","foo" => 304 (meaning they are not escaping " in the quoted
                            string)
Jigsaw:
INM: "foo"        => 304 OK
INM: "fo\o"       => 304 OK
INM: "foo\"       => 200 OK
INM: "fo\o","foo" => 304 OK
INM: "foo\","foo" => 200 OK

         ~~Yves

---

From: Mark Nottingham <[email-masked]>
Date: Fri, 29 Jul 2011 08:21:47 -0700

Thanks, Yves. Seems to support the change...

Cheers,