qnetworkcookiejar.cpp

Go to the documentation of this file.

// Copyright (C) 2016 The Qt Company Ltd.
// SPDX-License-Identifier: LicenseRef-Qt-Commercial OR LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only
 
#include "qnetworkcookiejar.h"
#include "qnetworkcookiejar_p.h"
 
#include "QtNetwork/qnetworkcookie.h"
#include "QtCore/qurl.h"
#include "QtCore/qdatetime.h"
#if QT_CONFIG(topleveldomain)
#include "private/qtldurl_p.h"
#else
QT_BEGIN_NAMESPACE
static bool qIsEffectiveTLD(QStringView domain)
{
    // provide minimal checking by not accepting cookies on real TLDs
    return !domain.contains(u'.');
}
QT_END_NAMESPACE
#endif
 
QT_BEGIN_NAMESPACE
 
using namespace Qt::StringLiterals;
 
QNetworkCookieJar::QNetworkCookieJar(QObject *parent)
    : QObject(*new QNetworkCookieJarPrivate, parent)
{
}
 
QNetworkCookieJar::~QNetworkCookieJar()
{
}
 
QList<QNetworkCookie> QNetworkCookieJar::allCookies() const
{
    return d_func()->allCookies;
}
 
void QNetworkCookieJar::setAllCookies(const QList<QNetworkCookie> &cookieList)
{
    Q_D(QNetworkCookieJar);
    d->allCookies = cookieList;
}
 
static inline bool isParentPath(const QString &path, const QString &reference)
{
    if ((path.isEmpty() && reference == "/"_L1) || path.startsWith(reference)) {
        //The cookie-path and the request-path are identical.
        if (path.size() == reference.size())
            return true;
        //The cookie-path is a prefix of the request-path, and the last
        //character of the cookie-path is %x2F ("/").
        if (reference.endsWith(u'/'))
            return true;
        //The cookie-path is a prefix of the request-path, and the first
        //character of the request-path that is not included in the cookie-
        //path is a %x2F ("/") character.
        if (path.at(reference.size()) == u'/')
            return true;
    }
    return false;
}
 
static inline bool isParentDomain(const QString &domain, const QString &reference)
{
    if (!reference.startsWith(u'.'))
        return domain == reference;
 
    return domain.endsWith(reference) || domain == QStringView{reference}.mid(1);
}
 
bool QNetworkCookieJar::setCookiesFromUrl(const QList<QNetworkCookie> &cookieList,
                                          const QUrl &url)
{
    bool added = false;
    for (QNetworkCookie cookie : cookieList) {
        cookie.normalize(url);
        if (validateCookie(cookie, url) && insertCookie(cookie))
            added = true;
    }
    return added;
}
 
QList<QNetworkCookie> QNetworkCookieJar::cookiesForUrl(const QUrl &url) const
{
//     \b Warning! This is only a dumb implementation!
//     It does NOT follow all of the recommendations from
//     http://wp.netscape.com/newsref/std/cookie_spec.html
//     It does not implement a very good cross-domain verification yet.
 
    Q_D(const QNetworkCookieJar);
    const QDateTime now = QDateTime::currentDateTimeUtc();
    QList<QNetworkCookie> result;
    bool isEncrypted = url.scheme() == "https"_L1;
 
    // scan our cookies for something that matches
    QList<QNetworkCookie>::ConstIterator it = d->allCookies.constBegin(),
                                        end = d->allCookies.constEnd();
    for ( ; it != end; ++it) {
        if (!isParentDomain(url.host(), it->domain()))
            continue;
        if (!isParentPath(url.path(), it->path()))
            continue;
        if (!(*it).isSessionCookie() && (*it).expirationDate() < now)
            continue;
        if ((*it).isSecure() && !isEncrypted)
            continue;
 
        QString domain = it->domain();
        if (domain.startsWith(u'.')) 
            domain = domain.mid(1);
#if QT_CONFIG(topleveldomain)
        if (qIsEffectiveTLD(domain) && url.host() != domain)
            continue;
#else
        if (!domain.contains(u'.') && url.host() != domain)
            continue;
#endif // topleveldomain
 
        // insert this cookie into result, sorted by path
        QList<QNetworkCookie>::Iterator insertIt = result.begin();
        while (insertIt != result.end()) {
            if (insertIt->path().size() < it->path().size()) {
                // insert here
                insertIt = result.insert(insertIt, *it);
                break;
            } else {
                ++insertIt;
            }
        }
 
        // this is the shortest path yet, just append
        if (insertIt == result.end())
            result += *it;
    }
 
    return result;
}
 
bool QNetworkCookieJar::insertCookie(const QNetworkCookie &cookie)
{
    Q_D(QNetworkCookieJar);
    const QDateTime now = QDateTime::currentDateTimeUtc();
    bool isDeletion = !cookie.isSessionCookie() &&
                      cookie.expirationDate() < now;
 
    deleteCookie(cookie);
 
    if (!isDeletion) {
        d->allCookies += cookie;
        return true;
    }
    return false;
}
 
bool QNetworkCookieJar::updateCookie(const QNetworkCookie &cookie)
{
    if (deleteCookie(cookie))
        return insertCookie(cookie);
    return false;
}
 
bool QNetworkCookieJar::deleteCookie(const QNetworkCookie &cookie)
{
    Q_D(QNetworkCookieJar);
    QList<QNetworkCookie>::Iterator it;
    for (it = d->allCookies.begin(); it != d->allCookies.end(); ++it) {
        if (it->hasSameIdentifier(cookie)) {
            d->allCookies.erase(it);
            return true;
        }
    }
    return false;
}
 
bool QNetworkCookieJar::validateCookie(const QNetworkCookie &cookie, const QUrl &url) const
{
    QString domain = cookie.domain();
    const QString host = url.host();
    if (!isParentDomain(domain, host) && !isParentDomain(host, domain))
        return false; // not accepted
 
    if (domain.startsWith(u'.'))
        domain = domain.mid(1);
 
    // We shouldn't reject if:
    // "[...] the domain-attribute is identical to the canonicalized request-host"
    // https://tools.ietf.org/html/rfc6265#section-5.3 step 5
    if (host == domain)
        return true;
    // the check for effective TLDs makes the "embedded dot" rule from RFC 2109 section 4.3.2
    // redundant; the "leading dot" rule has been relaxed anyway, see QNetworkCookie::normalize()
    // we remove the leading dot for this check if it's present
    // Normally defined in qtldurl_p.h, but uses fall-back in this file when topleveldomain isn't
    // configured:
    return !qIsEffectiveTLD(domain);
}
 
QT_END_NAMESPACE
 
#include "moc_qnetworkcookiejar.cpp"