dmaax/ladybird
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

LibHTTP: Treat PSL star-rule domains as public suffixes

Browse source 
Use IncludeStarRule::Yes for cookie public-suffix checks so domains not
explicitly listed in the PSL still get treated as public suffixes via
the implicit * rule. This fixes accepting cookies for bare TLD-like
domains.
This commit is contained in:
Shannon Booth 2026-06-15 12:40:35 +02:00 committed by Shannon Booth
parent 3f7b31fc78
commit 6719f01a40
3 changed files with 4 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
Libraries/LibHTTP/Cookie/Cookie.cpp
View file

@ -162,7 +162,7 @@ bool cookie_matches_url(Cookie const& cookie, URL::URL const& url, String const&
// the cookie's domain.
// - The cookie's domain is not a public suffix, for user agents configured to reject "public suffixes".
bool is_not_host_only_and_domain_matches = (!cookie.host_only && domain_matches(retrieval_host_canonical, cookie.domain))
&& !URL::PublicSuffixData::is_matching_public_suffix(cookie.domain, URL::PublicSuffixData::IncludeStarRule::No);
&& !URL::PublicSuffixData::is_matching_public_suffix(cookie.domain, URL::PublicSuffixData::IncludeStarRule::Yes);
if (!is_host_only_and_has_identical_domain && !is_not_host_only_and_domain_matches)
return false;

2
Libraries/LibWebView/CookieJar.cpp
View file

@ -228,7 +228,7 @@ ErrorOr<void> CookieJar::set_cookie(URL::URL const& url, HTTP::Cookie::ParsedCoo
return Error::from_string_literal("Cookie URL host cannot be canonicalized");
// 9. If the user agent is configured to reject "public suffixes" and the domain-attribute is a public suffix:
if (URL::PublicSuffixData::is_matching_public_suffix(domain_attribute, URL::PublicSuffixData::IncludeStarRule::No)) {
if (URL::PublicSuffixData::is_matching_public_suffix(domain_attribute, URL::PublicSuffixData::IncludeStarRule::Yes)) {
// 1. Let request-host-canonical be the canonicalized request-host.
// 2. If request-host fails to be canonicalized then abort this algorithm and ignore the cookie entirely.

5
Tests/LibWeb/Text/expected/wpt-import/cookies/attributes/domain.sub.txt
View file

@ -2,8 +2,7 @@ Harness status: OK
Found 55 tests
54 Pass
1 Fail
55 Pass
Pass Test cookie domain attribute parsing
Pass Return cookie for a domain match
Pass No cookie returned for domain mismatch (subdomains differ post-redirect)
@ -21,7 +20,7 @@ Pass No cookie returned for domain attribute with whitespace that surrounds a le
Pass No cookie returned for domain attribute with trailing '.'
Pass No cookie returned for domain attribute with trailing '..'
Pass No cookie returned for domain attribute with trailing whitespace and '.'
Fail No cookie returned for domain attribute with TLD as value
Pass No cookie returned for domain attribute with TLD as value
Pass No cookie returned for domain attribute with TLD as value, with leading '.'
Pass No cookie returned for domain attribute with TLD as value, with leading and trailing '.'
Pass Return multiple cookies that match on domain (without and with leading '.')