mirrors/ladybird
0
0
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird.git synced 2025-08-11 18:50:50 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 10

LibWeb+LibWebView: Implement the latest cookie draft RFC

Browse source 
We currently implement the official cookie RFC, which was last updated
in 2011. Unfortunately, web reality conflicts with the RFC. For example,
all of the major browsers allow nameless cookies, which the RFC forbids.

There has since been draft versions of the RFC published to address such
issues. This patch implements the latest draft.

Major differences include:
* Allowing nameless or valueless (but not both) cookies
* Formal cookie length limits
* Formal same-site rules (not fully implemented here)
* More rules around cookie domains
This commit is contained in:
Timothy Flynn 2024-09-16 15:20:01 -04:00 • committed by Tim Ledbetter
commit fce003a8f5
Notes: github-actions[bot] 2024-09-16 23:05:30 +00:00
7 changed files with 548 additions and 176 deletions
Download patch file Download diff file Expand all files Collapse all files

277
Userland/Libraries/LibWeb/Cookie/ParsedCookie.cpp
View file

@ -17,8 +17,6 @@
namespace Web::Cookie {
static constexpr size_t s_max_cookie_size = 4096;
static void parse_attributes(ParsedCookie& parsed_cookie, StringView unparsed_attributes);
static void process_attribute(ParsedCookie& parsed_cookie, StringView attribute_name, StringView attribute_value);
static void on_expires_attribute(ParsedCookie& parsed_cookie, StringView attribute_value);
@ -30,49 +28,69 @@ static void on_http_only_attribute(ParsedCookie& parsed_cookie);
static void on_same_site_attribute(ParsedCookie& parsed_cookie, StringView attribute_value);
static Optional<UnixDateTime> parse_date_time(StringView date_string);
bool cookie_contains_invalid_control_character(StringView cookie_string)
{
for (auto code_point : Utf8View { cookie_string }) {
if (code_point <= 0x08)
return true;
if (code_point >= 0x0a && code_point <= 0x1f)
return true;
if (code_point == 0x7f)
return true;
}
return false;
}
// https://www.ietf.org/archive/id/draft-ietf-httpbis-rfc6265bis-15.html#section-5.6-6
Optional<ParsedCookie> parse_cookie(StringView cookie_string)
{
// https://tools.ietf.org/html/rfc6265#section-5.2
if (cookie_string.length() > s_max_cookie_size)
// 1. If the set-cookie-string contains a %x00-08 / %x0A-1F / %x7F character (CTL characters excluding HTAB):
// Abort these steps and ignore the set-cookie-string entirely.
if (cookie_contains_invalid_control_character(cookie_string))
return {};
StringView name_value_pair;
StringView unparsed_attributes;
// 1. If the set-cookie-string contains a %x3B (";") character:
// 2. If the set-cookie-string contains a %x3B (";") character:
if (auto position = cookie_string.find(';'); position.has_value()) {
// The name-value-pair string consists of the characters up to, but not including, the first %x3B (";"), and the unparsed-
// attributes consist of the remainder of the set-cookie-string (including the %x3B (";") in question).
// 1. The name-value-pair string consists of the characters up to, but not including, the first %x3B (";"), and
// the unparsed-attributes consist of the remainder of the set-cookie-string (including the %x3B (";") in
// question).
name_value_pair = cookie_string.substring_view(0, position.value());
unparsed_attributes = cookie_string.substring_view(position.value());
} else {
// The name-value-pair string consists of all the characters contained in the set-cookie-string, and the unparsed-
// attributes is the empty string.
}
// Otherwise:
else {
// 1. The name-value-pair string consists of all the characters contained in the set-cookie-string, and the
// unparsed-attributes is the empty string.
name_value_pair = cookie_string;
}
StringView name;
StringView value;
if (auto position = name_value_pair.find('='); position.has_value()) {
// 3. The (possibly empty) name string consists of the characters up to, but not including, the first %x3D ("=") character, and the
// (possibly empty) value string consists of the characters after the first %x3D ("=") character.
// 3. If the name-value-pair string lacks a %x3D ("=") character, then the name string is empty, and the value
// string is the value of name-value-pair.
if (auto position = name_value_pair.find('='); !position.has_value()) {
value = name_value_pair;
} else {
// Otherwise, the name string consists of the characters up to, but not including, the first %x3D ("=") character
// and the (possibly empty) value string consists of the characters after the first %x3D ("=") character.
name = name_value_pair.substring_view(0, position.value());
if (position.value() < name_value_pair.length() - 1)
value = name_value_pair.substring_view(position.value() + 1);
} else {
// 2. If the name-value-pair string lacks a %x3D ("=") character, ignore the set-cookie-string entirely.
return {};
}
// 4. Remove any leading or trailing WSP characters from the name string and the value string.
name = name.trim_whitespace();
value = value.trim_whitespace();
// 5. If the name string is empty, ignore the set-cookie-string entirely.
if (name.is_empty())
// 5. If the sum of the lengths of the name string and the value string is more than 4096 octets, abort these steps
// and ignore the set-cookie-string entirely.
if (name.length() + value.length() > 4096)
return {};
// 6. The cookie-name is the name string, and the cookie-value is the value string.
@ -82,6 +100,7 @@ Optional<ParsedCookie> parse_cookie(StringView cookie_string)
return parsed_cookie;
}
// https://www.ietf.org/archive/id/draft-ietf-httpbis-rfc6265bis-15.html#section-5.6-8
void parse_attributes(ParsedCookie& parsed_cookie, StringView unparsed_attributes)
{
// 1. If the unparsed-attributes string is empty, skip the rest of these steps.
@ -95,28 +114,34 @@ void parse_attributes(ParsedCookie& parsed_cookie, StringView unparsed_attribute
// 3. If the remaining unparsed-attributes contains a %x3B (";") character:
if (auto position = unparsed_attributes.find(';'); position.has_value()) {
// Consume the characters of the unparsed-attributes up to, but not including, the first %x3B (";") character.
// 1. Consume the characters of the unparsed-attributes up to, but not including, the first %x3B (";") character.
cookie_av = unparsed_attributes.substring_view(0, position.value());
unparsed_attributes = unparsed_attributes.substring_view(position.value());
} else {
// Consume the remainder of the unparsed-attributes.
}
// Otherwise:
else {
// 1. Consume the remainder of the unparsed-attributes.
cookie_av = unparsed_attributes;
unparsed_attributes = {};
}
// Let the cookie-av string be the characters consumed in this step.
StringView attribute_name;
StringView attribute_value;
// 4. If the cookie-av string contains a %x3D ("=") character:
if (auto position = cookie_av.find('='); position.has_value()) {
// The (possibly empty) attribute-name string consists of the characters up to, but not including, the first %x3D ("=")
// character, and the (possibly empty) attribute-value string consists of the characters after the first %x3D ("=") character.
// 1. The (possibly empty) attribute-name string consists of the characters up to, but not including, the first
// %x3D ("=") character, and the (possibly empty) attribute-value string consists of the characters after the
// first %x3D ("=") character.
attribute_name = cookie_av.substring_view(0, position.value());
if (position.value() < cookie_av.length() - 1)
attribute_value = cookie_av.substring_view(position.value() + 1);
} else {
// The attribute-name string consists of the entire cookie-av string, and the attribute-value string is empty.
}
// Otherwise:
else {
// 1. The attribute-name string consists of the entire cookie-av string, and the attribute-value string is empty.
attribute_name = cookie_av;
}
@ -124,11 +149,18 @@ void parse_attributes(ParsedCookie& parsed_cookie, StringView unparsed_attribute
attribute_name = attribute_name.trim_whitespace();
attribute_value = attribute_value.trim_whitespace();
// 6. Process the attribute-name and attribute-value according to the requirements in the following subsections.
// 6. If the attribute-value is longer than 1024 octets, ignore the cookie-av string and return to Step 1 of this
// algorithm.
if (attribute_value.length() > 1024) {
parse_attributes(parsed_cookie, unparsed_attributes);
return;
}
// 7. Process the attribute-name and attribute-value according to the requirements in the following subsections.
// (Notice that attributes with unrecognized attribute-names are ignored.)
process_attribute(parsed_cookie, attribute_name, attribute_value);
// 7. Return to Step 1 of this algorithm.
// 8. Return to Step 1 of this algorithm.
parse_attributes(parsed_cookie, unparsed_attributes);
}
@ -151,92 +183,139 @@ void process_attribute(ParsedCookie& parsed_cookie, StringView attribute_name, S
}
}
static constexpr AK::Duration maximum_cookie_age()
{
return AK::Duration::from_seconds(400LL * 24 * 60 * 60);
}
// https://www.ietf.org/archive/id/draft-ietf-httpbis-rfc6265bis-15.html#section-5.6.1
void on_expires_attribute(ParsedCookie& parsed_cookie, StringView attribute_value)
{
// https://tools.ietf.org/html/rfc6265#section-5.2.1
if (auto expiry_time = parse_date_time(attribute_value); expiry_time.has_value())
parsed_cookie.expiry_time_from_expires_attribute = expiry_time.release_value();
}
// 1. Let the expiry-time be the result of parsing the attribute-value as cookie-date (see Section 5.1.1).
auto expiry_time = parse_date_time(attribute_value);
void on_max_age_attribute(ParsedCookie& parsed_cookie, StringView attribute_value)
{
// https://tools.ietf.org/html/rfc6265#section-5.2.2
// If the first character of the attribute-value is not a DIGIT or a "-" character, ignore the cookie-av.
if (attribute_value.is_empty() || (!isdigit(attribute_value[0]) && (attribute_value[0] != '-')))
// 2. If the attribute-value failed to parse as a cookie date, ignore the cookie-av.
if (!expiry_time.has_value())
return;
// Let delta-seconds be the attribute-value converted to an integer.
if (auto delta_seconds = attribute_value.to_number<int>(); delta_seconds.has_value()) {
if (*delta_seconds <= 0) {
// If delta-seconds is less than or equal to zero (0), let expiry-time be the earliest representable date and time.
parsed_cookie.expiry_time_from_max_age_attribute = UnixDateTime::earliest();
} else {
// Otherwise, let the expiry-time be the current date and time plus delta-seconds seconds.
parsed_cookie.expiry_time_from_max_age_attribute = UnixDateTime::now() + AK::Duration::from_seconds(*delta_seconds);
}
}
// 3. Let cookie-age-limit be the maximum age of the cookie (which SHOULD be 400 days in the future or sooner, see
// Section 5.5).
auto cookie_age_limit = UnixDateTime::now() + maximum_cookie_age();
// 4. If the expiry-time is more than cookie-age-limit, the user agent MUST set the expiry time to cookie-age-limit
// in seconds.
if (expiry_time->seconds_since_epoch() > cookie_age_limit.seconds_since_epoch())
expiry_time = cookie_age_limit;
// 5. If the expiry-time is earlier than the earliest date the user agent can represent, the user agent MAY replace
// the expiry-time with the earliest representable date.
if (auto earliest = UnixDateTime::earliest(); *expiry_time < earliest)
expiry_time = earliest;
// 6. Append an attribute to the cookie-attribute-list with an attribute-name of Expires and an attribute-value of
// expiry-time.
parsed_cookie.expiry_time_from_expires_attribute = expiry_time.release_value();
}
void on_domain_attribute(ParsedCookie& parsed_cookie, StringView attribute_value)
// https://www.ietf.org/archive/id/draft-ietf-httpbis-rfc6265bis-15.html#section-5.6.2
void on_max_age_attribute(ParsedCookie& parsed_cookie, StringView attribute_value)
{
// https://tools.ietf.org/html/rfc6265#section-5.2.3
// If the attribute-value is empty, the behavior is undefined. However, the user agent SHOULD ignore the cookie-av entirely.
// 1. If the attribute-value is empty, ignore the cookie-av.
if (attribute_value.is_empty())
return;
StringView cookie_domain;
// If the first character of the attribute-value string is %x2E ("."):
if (attribute_value[0] == '.') {
// Let cookie-domain be the attribute-value without the leading %x2E (".") character.
cookie_domain = attribute_value.substring_view(1);
} else {
// Let cookie-domain be the entire attribute-value.
cookie_domain = attribute_value;
}
// Convert the cookie-domain to lower case.
parsed_cookie.domain = MUST(Infra::to_ascii_lowercase(cookie_domain));
}
void on_path_attribute(ParsedCookie& parsed_cookie, StringView attribute_value)
{
// https://tools.ietf.org/html/rfc6265#section-5.2.4
// If the attribute-value is empty or if the first character of the attribute-value is not %x2F ("/"):
if (attribute_value.is_empty() || attribute_value[0] != '/')
// Let cookie-path be the default-path.
// 2. If the first character of the attribute-value is neither a DIGIT, nor a "-" character followed by a DIGIT,
// ignore the cookie-av.
if (!is_ascii_digit(attribute_value[0]) && attribute_value[0] != '-')
return;
// Let cookie-path be the attribute-value
parsed_cookie.path = MUST(String::from_utf8(attribute_value));
// 3. If the remainder of attribute-value contains a non-DIGIT character, ignore the cookie-av.
// 4. Let delta-seconds be the attribute-value converted to a base 10 integer.
auto delta_seconds = attribute_value.to_number<i64>();
if (!delta_seconds.has_value())
return;
// 5. Let cookie-age-limit be the maximum age of the cookie (which SHOULD be 400 days or less, see Section 5.5).
auto cookie_age_limit = maximum_cookie_age();
// 6. Set delta-seconds to the smaller of its present value and cookie-age-limit.
if (*delta_seconds > cookie_age_limit.to_seconds())
delta_seconds = cookie_age_limit.to_seconds();
// 7. If delta-seconds is less than or equal to zero (0), let expiry-time be the earliest representable date and
// time. Otherwise, let the expiry-time be the current date and time plus delta-seconds seconds.
auto expiry_time = *delta_seconds <= 0
? UnixDateTime::earliest()
: UnixDateTime::now() + AK::Duration::from_seconds(*delta_seconds);
// 8. Append an attribute to the cookie-attribute-list with an attribute-name of Max-Age and an attribute-value of
// expiry-time.
parsed_cookie.expiry_time_from_max_age_attribute = expiry_time;
}
// https://www.ietf.org/archive/id/draft-ietf-httpbis-rfc6265bis-15.html#section-5.6.3
void on_domain_attribute(ParsedCookie& parsed_cookie, StringView attribute_value)
{
// 1. Let cookie-domain be the attribute-value.
auto cookie_domain = attribute_value;
// 2. If cookie-domain starts with %x2E ("."), let cookie-domain be cookie-domain without its leading %x2E (".").
if (cookie_domain.starts_with('.'))
cookie_domain = cookie_domain.substring_view(1);
// 3. Convert the cookie-domain to lower case.
auto lowercase_cookie_domain = MUST(Infra::to_ascii_lowercase(cookie_domain));
// 4. Append an attribute to the cookie-attribute-list with an attribute-name of Domain and an attribute-value of
// cookie-domain.
parsed_cookie.domain = move(lowercase_cookie_domain);
}
// https://www.ietf.org/archive/id/draft-ietf-httpbis-rfc6265bis-15.html#section-5.6.4
void on_path_attribute(ParsedCookie& parsed_cookie, StringView attribute_value)
{
// 1. If the attribute-value is empty or if the first character of the attribute-value is not %x2F ("/"):
if (attribute_value.is_empty() || attribute_value[0] != '/') {
// Let cookie-path be the default-path.
return;
}
// Otherwise:
// 1. Let cookie-path be the attribute-value.
auto cookie_path = attribute_value;
// 2. Append an attribute to the cookie-attribute-list with an attribute-name of Path and an attribute-value of
// cookie-path.
parsed_cookie.path = MUST(String::from_utf8(cookie_path));
}
// https://www.ietf.org/archive/id/draft-ietf-httpbis-rfc6265bis-15.html#section-5.6.5
void on_secure_attribute(ParsedCookie& parsed_cookie)
{
// https://tools.ietf.org/html/rfc6265#section-5.2.5
parsed_cookie.secure_attribute_present = true;
}
// https://www.ietf.org/archive/id/draft-ietf-httpbis-rfc6265bis-15.html#section-5.6.6
void on_http_only_attribute(ParsedCookie& parsed_cookie)
{
// https://tools.ietf.org/html/rfc6265#section-5.2.6
parsed_cookie.http_only_attribute_present = true;
}
// https://httpwg.org/http-extensions/draft-ietf-httpbis-rfc6265bis.html#name-the-samesite-attribute-2
// https://www.ietf.org/archive/id/draft-ietf-httpbis-rfc6265bis-15.html#section-5.6.7
void on_same_site_attribute(ParsedCookie& parsed_cookie, StringView attribute_value)
{
// 1. Let enforcement be "Default"
// 1. Let enforcement be "Default".
// 2. If cookie-av's attribute-value is a case-insensitive match for "None", set enforcement to "None".
// 3. If cookie-av's attribute-value is a case-insensitive match for "Strict", set enforcement to "Strict".
// 4. If cookie-av's attribute-value is a case-insensitive match for "Lax", set enforcement to "Lax".
parsed_cookie.same_site_attribute = same_site_from_string(attribute_value);
auto enforcement = same_site_from_string(attribute_value);
// 5. Append an attribute to the cookie-attribute-list with an attribute-name of "SameSite" and an attribute-value
// of enforcement.
parsed_cookie.same_site_attribute = enforcement;
}
// https://www.ietf.org/archive/id/draft-ietf-httpbis-rfc6265bis-15.html#section-5.1.1
Optional<UnixDateTime> parse_date_time(StringView date_string)
{
// https://tools.ietf.org/html/rfc6265#section-5.1.1
@ -302,20 +381,38 @@ Optional<UnixDateTime> parse_date_time(StringView date_string)
// 1. Using the grammar below, divide the cookie-date into date-tokens.
Vector<StringView> date_tokens = date_string.split_view_if(is_delimiter);
// 2. Process each date-token sequentially in the order the date-tokens appear in the cookie-date.
// 2. Process each date-token sequentially in the order the date-tokens appear in the cookie-date:
bool found_time = false;
bool found_day_of_month = false;
bool found_month = false;
bool found_year = false;
for (auto const& date_token : date_tokens) {
// 1. If the found-time flag is not set and the token matches the time production, set the found-time flag and
// set the hour-value, minute-value, and second-value to the numbers denoted by the digits in the date-token,
// respectively. Skip the remaining sub-steps and continue to the next date-token.
if (!found_time && parse_time(date_token)) {
found_time = true;
} else if (!found_day_of_month && parse_day_of_month(date_token)) {
}
// 2. If the found-day-of-month flag is not set and the date-token matches the day-of-month production, set the
// found-day-of-month flag and set the day-of-month-value to the number denoted by the date-token. Skip the
// remaining sub-steps and continue to the next date-token.
else if (!found_day_of_month && parse_day_of_month(date_token)) {
found_day_of_month = true;
} else if (!found_month && parse_month(date_token)) {
}
// 3. If the found-month flag is not set and the date-token matches the month production, set the found-month
// flag and set the month-value to the month denoted by the date-token. Skip the remaining sub-steps and
// continue to the next date-token.
else if (!found_month && parse_month(date_token)) {
found_month = true;
} else if (!found_year && parse_year(date_token)) {
}
// 4. If the found-year flag is not set and the date-token matches the year production, set the found-year flag
// and set the year-value to the number denoted by the date-token. Skip the remaining sub-steps and continue
// to the next date-token.
else if (!found_year && parse_year(date_token)) {
found_year = true;
}
}
@ -329,16 +426,22 @@ Optional<UnixDateTime> parse_date_time(StringView date_string)
year += 2000;
// 5. Abort these steps and fail to parse the cookie-date if:
if (!found_time || !found_day_of_month || !found_month || !found_year)
// * at least one of the found-day-of-month, found-month, found-year, or found-time flags is not set,
if (!found_day_of_month || !found_month || !found_year || !found_time)
return {};
// * the day-of-month-value is less than 1 or greater than 31,
if (day_of_month < 1 || day_of_month > 31)
return {};
// * the year-value is less than 1601,
if (year < 1601)
return {};
// * the hour-value is greater than 23,
if (hour > 23)
return {};
// * the minute-value is greater than 59, or
if (minute > 59)
return {};
// * the second-value is greater than 59.
if (second > 59)
return {};