mirror of
https://github.com/mozilla-firefox/firefox
synced 2026-08-11 12:19:28 +00:00
103 lines
3.6 KiB
C++
103 lines
3.6 KiB
C++
/* This Source Code Form is subject to the terms of the Mozilla Public
|
|
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
|
|
|
|
#include "CookiePrefixes.h"
|
|
|
|
namespace mozilla::net {
|
|
|
|
namespace {
|
|
|
|
struct CookiePrefix {
|
|
CookiePrefixes::Prefix mPrefix;
|
|
nsCString mPrefixCString;
|
|
nsString mPrefixString;
|
|
std::function<bool(const CookieStruct&, bool)> mCallback;
|
|
};
|
|
|
|
// Ordered longest-prefix-first so that more specific prefixes (e.g.
|
|
// __Host-Http-) are checked before shorter prefixes they start with (e.g.
|
|
// __Host-), since Check() returns on the first match.
|
|
//
|
|
// Per RFC 6265bis §5.4, UAs MUST match these prefixes case-insensitively
|
|
// (see Check() below), even though §4.1.3 describes them with "case-sensitive
|
|
// match" language — that wording applies to server-side semantics, not UA
|
|
// enforcement.
|
|
MOZ_RUNINIT CookiePrefix gCookiePrefixes[] = {
|
|
{CookiePrefixes::eHostHttp, "__Host-Http-"_ns, u"__Host-Http-"_ns,
|
|
[](const CookieStruct& aCookieData, bool aSecureRequest) -> bool {
|
|
// RFC 6265bis §4.1.3: the __Host-Http- prefix requires Secure,
|
|
// HttpOnly, Path=/, and no Domain attribute.
|
|
return aSecureRequest && aCookieData.isSecure() &&
|
|
aCookieData.isHttpOnly() && aCookieData.host()[0] != '.' &&
|
|
aCookieData.path().EqualsLiteral("/");
|
|
}},
|
|
|
|
{CookiePrefixes::eHost, "__Host-"_ns, u"__Host-"_ns,
|
|
[](const CookieStruct& aCookieData, bool aSecureRequest) -> bool {
|
|
// RFC 6265bis §4.1.3: the __Host- prefix requires Secure, Path=/,
|
|
// and no Domain attribute.
|
|
return aSecureRequest && aCookieData.isSecure() &&
|
|
aCookieData.host()[0] != '.' &&
|
|
aCookieData.path().EqualsLiteral("/");
|
|
}},
|
|
|
|
{CookiePrefixes::eHttp, "__Http-"_ns, u"__Http-"_ns,
|
|
[](const CookieStruct& aCookieData, bool aSecureRequest) -> bool {
|
|
// RFC 6265bis §4.1.3: the __Http- prefix requires Secure and HttpOnly.
|
|
return aSecureRequest && aCookieData.isSecure() &&
|
|
aCookieData.isHttpOnly();
|
|
}},
|
|
|
|
{CookiePrefixes::eSecure, "__Secure-"_ns, u"__Secure-"_ns,
|
|
[](const CookieStruct& aCookieData, bool aSecureRequest) -> bool {
|
|
// RFC 6265bis §4.1.3: the __Secure- prefix requires Secure.
|
|
return aSecureRequest && aCookieData.isSecure();
|
|
}},
|
|
};
|
|
|
|
} // namespace
|
|
|
|
// static
|
|
bool CookiePrefixes::Has(Prefix aPrefix, const nsAString& aString) {
|
|
for (CookiePrefix& prefix : gCookiePrefixes) {
|
|
if (prefix.mPrefix == aPrefix) {
|
|
return StringBeginsWith(aString, prefix.mPrefixString,
|
|
nsCaseInsensitiveStringComparator);
|
|
}
|
|
}
|
|
|
|
return false;
|
|
}
|
|
|
|
// static
|
|
bool CookiePrefixes::Has(const nsACString& aString) {
|
|
for (CookiePrefix& prefix : gCookiePrefixes) {
|
|
if (StringBeginsWith(aString, prefix.mPrefixCString,
|
|
nsCaseInsensitiveCStringComparator)) {
|
|
return true;
|
|
}
|
|
}
|
|
|
|
return false;
|
|
}
|
|
|
|
// static
|
|
bool CookiePrefixes::Check(const CookieStruct& aCookieData,
|
|
bool aSecureRequest) {
|
|
// RFC 6265bis §5.4 requires UAs to match prefixes case-insensitively.
|
|
// This prevents servers that process cookie names case-insensitively from
|
|
// inadvertently accepting miscapitalized prefixes without their guarantees.
|
|
for (CookiePrefix& prefix : gCookiePrefixes) {
|
|
if (StringBeginsWith(aCookieData.name(), prefix.mPrefixCString,
|
|
nsCaseInsensitiveCStringComparator)) {
|
|
return prefix.mCallback(aCookieData, aSecureRequest);
|
|
}
|
|
}
|
|
|
|
// not one of the magic prefixes: carry on
|
|
return true;
|
|
}
|
|
|
|
} // namespace mozilla::net
|