Ejemplo n.º 1
0
    /** Match cookie domain attribute. */
    public boolean match(final Cookie cookie, final CookieOrigin origin) {
      if (cookie == null) {
        throw new IllegalArgumentException("Cookie may not be null");
      }
      if (origin == null) {
        throw new IllegalArgumentException("Cookie origin may not be null");
      }
      String host = origin.getHost().toLowerCase();
      String cookieDomain = cookie.getDomain();

      // The effective host name MUST domain-match the Domain
      // attribute of the cookie.
      if (!domainMatch(host, cookieDomain)) {
        return false;
      }
      // effective host name minus domain must not contain any dots
      String effectiveHostWithoutDomain = host.substring(0, host.length() - cookieDomain.length());
      if (effectiveHostWithoutDomain.indexOf('.') != -1) {
        return false;
      }
      return true;
    }
Ejemplo n.º 2
0
    /** Validate cookie domain attribute. */
    public void validate(final Cookie cookie, final CookieOrigin origin)
        throws MalformedCookieException {
      if (cookie == null) {
        throw new IllegalArgumentException("Cookie may not be null");
      }
      if (origin == null) {
        throw new IllegalArgumentException("Cookie origin may not be null");
      }
      String host = origin.getHost().toLowerCase();
      if (cookie.getDomain() == null) {
        throw new MalformedCookieException("Invalid cookie state: " + "domain not specified");
      }
      String cookieDomain = cookie.getDomain().toLowerCase();

      if (cookie.isDomainAttributeSpecified()) {
        // Domain attribute must start with a dot
        if (!cookieDomain.startsWith(".")) {
          throw new MalformedCookieException(
              "Domain attribute \""
                  + cookie.getDomain()
                  + "\" violates RFC 2109: domain must start with a dot");
        }

        // Domain attribute must contain atleast one embedded dot,
        // or the value must be equal to .local.
        int dotIndex = cookieDomain.indexOf('.', 1);
        if (((dotIndex < 0) || (dotIndex == cookieDomain.length() - 1))
            && (!cookieDomain.equals(".local"))) {
          throw new MalformedCookieException(
              "Domain attribute \""
                  + cookie.getDomain()
                  + "\" violates RFC 2965: the value contains no embedded dots "
                  + "and the value is not .local");
        }

        // The effective host name must domain-match domain attribute.
        if (!domainMatch(host, cookieDomain)) {
          throw new MalformedCookieException(
              "Domain attribute \""
                  + cookie.getDomain()
                  + "\" violates RFC 2965: effective host name does not "
                  + "domain-match domain attribute.");
        }

        // effective host name minus domain must not contain any dots
        String effectiveHostWithoutDomain =
            host.substring(0, host.length() - cookieDomain.length());
        if (effectiveHostWithoutDomain.indexOf('.') != -1) {
          throw new MalformedCookieException(
              "Domain attribute \""
                  + cookie.getDomain()
                  + "\" violates RFC 2965: "
                  + "effective host minus domain may not contain any dots");
        }
      } else {
        // Domain was not specified in header. In this case, domain must
        // string match request host (case-insensitive).
        if (!cookie.getDomain().equals(host)) {
          throw new MalformedCookieException(
              "Illegal domain attribute: \""
                  + cookie.getDomain()
                  + "\"."
                  + "Domain of origin: \""
                  + host
                  + "\"");
        }
      }
    }