diff options
| author | Patrick Griffis <pgriffis@igalia.com> | 2023-01-22 17:35:03 -0600 |
|---|---|---|
| committer | Patrick Griffis <pgriffis@igalia.com> | 2023-01-23 09:51:15 -0600 |
| commit | cf5ce3ece31bcf952afa86c53107ed94ec55b80e (patch) | |
| tree | db615b4c2d61da480c09d59dc376090c4427e7a9 | |
| parent | e14136ebef1dd48271cebd95120ffd122079d05c (diff) | |
| download | libsoup-cf5ce3ece31bcf952afa86c53107ed94ec55b80e.tar.gz | |
cookie-jar: Fix valid Secure cookies being rejected
The documentation for soup_cookie_jar_add_cookie_full() states
NULL uris are always treated as a secure origin.
| -rw-r--r-- | libsoup/cookies/soup-cookie-jar.c | 8 | ||||
| -rw-r--r-- | tests/cookies-test.c | 11 |
2 files changed, 13 insertions, 6 deletions
diff --git a/libsoup/cookies/soup-cookie-jar.c b/libsoup/cookies/soup-cookie-jar.c index 43f75046..1609a567 100644 --- a/libsoup/cookies/soup-cookie-jar.c +++ b/libsoup/cookies/soup-cookie-jar.c @@ -644,16 +644,16 @@ soup_cookie_jar_add_cookie_full (SoupCookieJar *jar, SoupCookie *cookie, GUri *u #define MATCH_PREFIX(name, prefix) (!g_ascii_strncasecmp (name, prefix, strlen(prefix))) /* Cookies with a "__Secure-" prefix should have Secure attribute set and it must be for a secure host. */ - if (MATCH_PREFIX (soup_cookie_get_name (cookie), "__Secure-") && (!soup_cookie_get_secure (cookie) || !uri)) { + if (MATCH_PREFIX (soup_cookie_get_name (cookie), "__Secure-") && !soup_cookie_get_secure (cookie) ) { soup_cookie_free (cookie); return; } /* Path=/ and Secure attributes are required; Domain attribute must not be present. - Note that SoupCookie always sets the domain so we do exact host matches instead of subdomain matches. */ + Note that SoupCookie always sets the domain so we ensure its not a subdomain match. */ if (MATCH_PREFIX (soup_cookie_get_name (cookie), "__Host-")) { - if ((!soup_cookie_get_secure (cookie) || !uri) || + if (!soup_cookie_get_secure (cookie) || strcmp (soup_cookie_get_path (cookie), "/") != 0 || - g_ascii_strcasecmp (soup_cookie_get_domain (cookie), g_uri_get_host (uri)) != 0) { + soup_cookie_get_domain (cookie)[0] == '.') { soup_cookie_free (cookie); return; } diff --git a/tests/cookies-test.c b/tests/cookies-test.c index 2780e0ad..cafa26e4 100644 --- a/tests/cookies-test.c +++ b/tests/cookies-test.c @@ -301,6 +301,10 @@ do_cookies_prefix_test (void) soup_cookie_jar_add_cookie_full (jar, soup_cookie_parse ("__SeCuRe-Valid-1=1; Path=/; Secure", secure_uri), secure_uri, NULL); + /* With NULL uri is considered secure */ + soup_cookie_jar_add_cookie_full (jar, soup_cookie_parse ("__secure-Valid-2=1; Path=/; Secure", secure_uri), + NULL, NULL); + /* Without Secure */ soup_cookie_jar_add_cookie_full (jar, soup_cookie_parse ("__SeCuRe-Invalid-1=1;", secure_uri), secure_uri, NULL); @@ -312,6 +316,9 @@ do_cookies_prefix_test (void) soup_cookie_jar_add_cookie_full (jar, soup_cookie_parse ("__HoSt-Valid-1=1; Path=/; Secure", secure_uri), secure_uri, NULL); + soup_cookie_jar_add_cookie_full (jar, soup_cookie_parse ("__HoSt-Valid-2=1; Path=/; Secure", secure_uri), + NULL, NULL); + /* Invalid Path */ soup_cookie_jar_add_cookie_full (jar, soup_cookie_parse ("__HOST-Invalid-1=1; Path=/Somethingelse; Secure", secure_uri), secure_uri, NULL); @@ -336,8 +343,8 @@ do_cookies_prefix_test (void) g_assert_true (strstr (soup_cookie_get_name (cookie), "Valid") != NULL); } - /* In total we expect 2 valid cookies above. */ - g_assert_cmpuint (g_slist_length (cookies), ==, 2); + /* In total we expect 4 valid cookies above. */ + g_assert_cmpuint (g_slist_length (cookies), ==, 4); g_slist_free_full (cookies, (GDestroyNotify)soup_cookie_free); g_uri_unref (insecure_uri); |