qnetworkcookiejar.cpp

Go to the documentation of this file.

// Copyright (C) 2016 The Qt Company Ltd.
// SPDX-License-Identifier: LicenseRef-Qt-Commercial OR LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only
 
#include "qnetworkcookiejar.h"
#include "qnetworkcookiejar_p.h"
 
#include "QtNetwork/qnetworkcookie.h"
#include "QtCore/qurl.h"
#include "QtCore/qdatetime.h"
#if QT_CONFIG(topleveldomain)
#include "private/qtldurl_p.h"
#else
QT_BEGIN_NAMESPACE
static bool qIsEffectiveTLD(QStringView domain)
{
    // provide minimal checking by not accepting cookies on real TLDs
    return !domain.contains(u'.');
}
QT_END_NAMESPACE
#endif
 
QT_BEGIN_NAMESPACE
 
using namespace Qt::StringLiterals;
 
QNetworkCookieJar::QNetworkCookieJar(QObject *parent)
    : QObject(*new QNetworkCookieJarPrivate, parent)
{
}
 
QNetworkCookieJar::~QNetworkCookieJar()
{
}
 
QList<QNetworkCookie> QNetworkCookieJar::allCookies() const
{
    return d_func()->allCookies;
}
 
void QNetworkCookieJar::setAllCookies(const QList<QNetworkCookie> &cookieList)
{
    Q_D(QNetworkCookieJar);
    d->allCookies = cookieList;
}
 
static inline bool isParentPath(QStringView path, QStringView reference)
{
    if ((path.isEmpty() && reference == "/"_L1) || path.startsWith(reference)) {
        //The cookie-path and the request-path are identical.
        if (path.size() == reference.size())
            return true;
        //The cookie-path is a prefix of the request-path, and the last
        //character of the cookie-path is %x2F ("/").
        if (reference.endsWith(u'/'))
            return true;
        //The cookie-path is a prefix of the request-path, and the first
        //character of the request-path that is not included in the cookie-
        //path is a %x2F ("/") character.
        if (path.at(reference.size()) == u'/')
            return true;
    }
    return false;
}
 
static inline bool isParentDomain(QStringView domain, QStringView reference)
{
    if (!reference.startsWith(u'.'))
        return domain == reference;
 
    return domain.endsWith(reference) || domain == reference.mid(1);
}
 
bool QNetworkCookieJar::setCookiesFromUrl(const QList<QNetworkCookie> &cookieList,
                                          const QUrl &url)
{
    bool added = false;
    for (QNetworkCookie cookie : cookieList) {
        cookie.normalize(url);
        if (validateCookie(cookie, url) && insertCookie(cookie))
            added = true;
    }
    return added;
}
 
QList<QNetworkCookie> QNetworkCookieJar::cookiesForUrl(const QUrl &url) const
{
//     \b Warning! This is only a dumb implementation!
//     It does NOT follow all of the recommendations from
//     http://wp.netscape.com/newsref/std/cookie_spec.html
//     It does not implement a very good cross-domain verification yet.
 
    Q_D(const QNetworkCookieJar);
    const QDateTime now = QDateTime::currentDateTimeUtc();
    QList<QNetworkCookie> result;
    const bool isEncrypted = url.scheme() == "https"_L1;
 
    // scan our cookies for something that matches
    for (const auto &cookie : std::as_const(d->allCookies)) {
        if (!isEncrypted && cookie.isSecure())
            continue;
        if (!cookie.isSessionCookie() && cookie.expirationDate() < now)
            continue;
        const QString urlHost = url.host();
        const QString cookieDomain = cookie.domain();
        if (!isParentDomain(urlHost, cookieDomain))
            continue;
        if (!isParentPath(url.path(), cookie.path()))
            continue;
 
        QStringView domain = cookieDomain;
        if (domain.startsWith(u'.')) 
            domain = domain.sliced(1);
#if QT_CONFIG(topleveldomain)
        if (urlHost != domain && qIsEffectiveTLD(domain))
            continue;
#else
        if (!domain.contains(u'.') && urlHost != domain)
            continue;
#endif // topleveldomain
 
        result += cookie;
    }
 
    auto longerPath = [](const auto &c1, const auto &c2)
                      { return c1.path().size() > c2.path().size(); };
    std::sort(result.begin(), result.end(), longerPath);
    return result;
}
 
bool QNetworkCookieJar::insertCookie(const QNetworkCookie &cookie)
{
    Q_D(QNetworkCookieJar);
    const QDateTime now = QDateTime::currentDateTimeUtc();
    bool isDeletion = !cookie.isSessionCookie() &&
                      cookie.expirationDate() < now;
 
    deleteCookie(cookie);
 
    if (!isDeletion) {
        d->allCookies += cookie;
        return true;
    }
    return false;
}
 
bool QNetworkCookieJar::updateCookie(const QNetworkCookie &cookie)
{
    if (deleteCookie(cookie))
        return insertCookie(cookie);
    return false;
}
 
bool QNetworkCookieJar::deleteCookie(const QNetworkCookie &cookie)
{
    Q_D(QNetworkCookieJar);
    const auto it = std::find_if(d->allCookies.cbegin(), d->allCookies.cend(),
                                 [&cookie](const auto &c) { return c.hasSameIdentifier(cookie); });
    if (it != d->allCookies.cend()) {
        d->allCookies.erase(it);
        return true;
    }
    return false;
}
 
bool QNetworkCookieJar::validateCookie(const QNetworkCookie &cookie, const QUrl &url) const
{
    const QString cookieDomain = cookie.domain();
    QStringView domain = cookieDomain;
    const QString host = url.host();
    if (!isParentDomain(domain, host) && !isParentDomain(host, domain))
        return false; // not accepted
 
    if (domain.startsWith(u'.'))
        domain = domain.sliced(1);
 
    // We shouldn't reject if:
    // "[...] the domain-attribute is identical to the canonicalized request-host"
    // https://tools.ietf.org/html/rfc6265#section-5.3 step 5
    if (host == domain)
        return true;
    // the check for effective TLDs makes the "embedded dot" rule from RFC 2109 section 4.3.2
    // redundant; the "leading dot" rule has been relaxed anyway, see QNetworkCookie::normalize()
    // we remove the leading dot for this check if it's present
    // Normally defined in qtldurl_p.h, but uses fall-back in this file when topleveldomain isn't
    // configured:
    return !qIsEffectiveTLD(domain);
}
 
QT_END_NAMESPACE
 
#include "moc_qnetworkcookiejar.cpp"