Subject: Re: bug#61411: [PATCH] Handle a case where url-basic-auth can crash

From: [email-masked]
Date: Sun, 26 Feb 2023 08:52:31 +0000

Hi Eli,

Thanks for responding; I incorrectly assumed because the patch was so 
trivial my description was enough. My bad!

Below is a snippet of elisp that when `M-x eval-buffer`'d crashes an 
`emacs -Q` and causes an `emacs -Q -l repro.el` to freeze indefinitely 
on e444115d026c809395d4d248a99bb467bc87bb1d

(require 'url)
(eval-when-compile (require 'cl-lib))

(cl-defun send-request (endpoint &key verb data headers noninteractive 
json noauth sync callback)
   (let* ((url-request-method (or verb "GET"))
          (url-cookie-trusted-urls '(".*"))
          (url-request-noninteractive noninteractive)
          (url-request-extra-headers
           `(("Referer" . ,endpoint)
	    ("X-CSRF-TOKEN" . nil)
             ("Cookie" . nil)))
          (url-request-data data))
     (if sync
         (with-current-buffer (url-retrieve-synchronously endpoint)
           (funcall (or callback #'identity) url-http-response-status))
       (url-retrieve
        endpoint
        (or callback #'identity)))))

(send-request "https://httpstat.us/401" :noninteractive t :sync t)

The linked API is a simple service used to return various status codes, 
in this instance always a 401 regardless of what authentication is 
passed.

I'm not sure if my patch is the best catch-all solution to the 
underlying issue (I confess, I don't fully understand why this crashes). 
With my simple patch applied though, Emacs continues as expected.

I hope this is enough information now, I apologize for the poor initial 
report. As I already had a patch ready, I didn't think I should have 
used `M-x report-emacs-bug` but I will in future :)