cookie.c 49 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447144814491450145114521453145414551456145714581459146014611462146314641465146614671468146914701471147214731474147514761477147814791480148114821483148414851486148714881489149014911492149314941495149614971498149915001501150215031504150515061507150815091510151115121513151415151516151715181519152015211522152315241525152615271528152915301531153215331534153515361537153815391540154115421543154415451546154715481549155015511552155315541555155615571558155915601561156215631564156515661567156815691570157115721573157415751576157715781579158015811582158315841585158615871588158915901591159215931594159515961597159815991600160116021603160416051606160716081609161016111612161316141615161616171618161916201621162216231624162516261627162816291630163116321633163416351636163716381639164016411642164316441645164616471648164916501651165216531654165516561657165816591660166116621663166416651666166716681669167016711672167316741675167616771678167916801681168216831684168516861687168816891690169116921693169416951696169716981699170017011702170317041705170617071708170917101711171217131714171517161717171817191720172117221723172417251726172717281729173017311732173317341735173617371738173917401741174217431744174517461747174817491750175117521753175417551756175717581759176017611762176317641765176617671768176917701771
  1. /***************************************************************************
  2. * _ _ ____ _
  3. * Project ___| | | | _ \| |
  4. * / __| | | | |_) | |
  5. * | (__| |_| | _ <| |___
  6. * \___|\___/|_| \_\_____|
  7. *
  8. * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
  9. *
  10. * This software is licensed as described in the file COPYING, which
  11. * you should have received as part of this distribution. The terms
  12. * are also available at https://curl.se/docs/copyright.html.
  13. *
  14. * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  15. * copies of the Software, and permit persons to whom the Software is
  16. * furnished to do so, under the terms of the COPYING file.
  17. *
  18. * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
  19. * KIND, either express or implied.
  20. *
  21. * SPDX-License-Identifier: curl
  22. *
  23. ***************************************************************************/
  24. /***
  25. RECEIVING COOKIE INFORMATION
  26. ============================
  27. struct CookieInfo *Curl_cookie_init(struct Curl_easy *data,
  28. const char *file, struct CookieInfo *inc, bool newsession);
  29. Inits a cookie struct to store data in a local file. This is always
  30. called before any cookies are set.
  31. struct Cookie *Curl_cookie_add(struct Curl_easy *data,
  32. struct CookieInfo *c, bool httpheader, bool noexpire,
  33. char *lineptr, const char *domain, const char *path,
  34. bool secure);
  35. The 'lineptr' parameter is a full "Set-cookie:" line as
  36. received from a server.
  37. The function need to replace previously stored lines that this new
  38. line supersedes.
  39. It may remove lines that are expired.
  40. It should return an indication of success/error.
  41. SENDING COOKIE INFORMATION
  42. ==========================
  43. struct Cookies *Curl_cookie_getlist(struct CookieInfo *cookie,
  44. char *host, char *path, bool secure);
  45. For a given host and path, return a linked list of cookies that
  46. the client should send to the server if used now. The secure
  47. boolean informs the cookie if a secure connection is achieved or
  48. not.
  49. It shall only return cookies that haven't expired.
  50. Example set of cookies:
  51. Set-cookie: PRODUCTINFO=webxpress; domain=.fidelity.com; path=/; secure
  52. Set-cookie: PERSONALIZE=none;expires=Monday, 13-Jun-1988 03:04:55 GMT;
  53. domain=.fidelity.com; path=/ftgw; secure
  54. Set-cookie: FidHist=none;expires=Monday, 13-Jun-1988 03:04:55 GMT;
  55. domain=.fidelity.com; path=/; secure
  56. Set-cookie: FidOrder=none;expires=Monday, 13-Jun-1988 03:04:55 GMT;
  57. domain=.fidelity.com; path=/; secure
  58. Set-cookie: DisPend=none;expires=Monday, 13-Jun-1988 03:04:55 GMT;
  59. domain=.fidelity.com; path=/; secure
  60. Set-cookie: FidDis=none;expires=Monday, 13-Jun-1988 03:04:55 GMT;
  61. domain=.fidelity.com; path=/; secure
  62. Set-cookie:
  63. Session_Key@6791a9e0-901a-11d0-a1c8-9b012c88aa77=none;expires=Monday,
  64. 13-Jun-1988 03:04:55 GMT; domain=.fidelity.com; path=/; secure
  65. ****/
  66. #include "curl_setup.h"
  67. #if !defined(CURL_DISABLE_HTTP) && !defined(CURL_DISABLE_COOKIES)
  68. #include "urldata.h"
  69. #include "cookie.h"
  70. #include "psl.h"
  71. #include "strtok.h"
  72. #include "sendf.h"
  73. #include "slist.h"
  74. #include "share.h"
  75. #include "strtoofft.h"
  76. #include "strcase.h"
  77. #include "curl_get_line.h"
  78. #include "curl_memrchr.h"
  79. #include "parsedate.h"
  80. #include "rename.h"
  81. #include "fopen.h"
  82. #include "strdup.h"
  83. /* The last 3 #include files should be in this order */
  84. #include "curl_printf.h"
  85. #include "curl_memory.h"
  86. #include "memdebug.h"
  87. static void strstore(char **str, const char *newstr, size_t len);
  88. static void freecookie(struct Cookie *co)
  89. {
  90. free(co->domain);
  91. free(co->path);
  92. free(co->spath);
  93. free(co->name);
  94. free(co->value);
  95. free(co);
  96. }
  97. static bool cookie_tailmatch(const char *cookie_domain,
  98. size_t cookie_domain_len,
  99. const char *hostname)
  100. {
  101. size_t hostname_len = strlen(hostname);
  102. if(hostname_len < cookie_domain_len)
  103. return FALSE;
  104. if(!strncasecompare(cookie_domain,
  105. hostname + hostname_len-cookie_domain_len,
  106. cookie_domain_len))
  107. return FALSE;
  108. /*
  109. * A lead char of cookie_domain is not '.'.
  110. * RFC6265 4.1.2.3. The Domain Attribute says:
  111. * For example, if the value of the Domain attribute is
  112. * "example.com", the user agent will include the cookie in the Cookie
  113. * header when making HTTP requests to example.com, www.example.com, and
  114. * www.corp.example.com.
  115. */
  116. if(hostname_len == cookie_domain_len)
  117. return TRUE;
  118. if('.' == *(hostname + hostname_len - cookie_domain_len - 1))
  119. return TRUE;
  120. return FALSE;
  121. }
  122. /*
  123. * matching cookie path and url path
  124. * RFC6265 5.1.4 Paths and Path-Match
  125. */
  126. static bool pathmatch(const char *cookie_path, const char *request_uri)
  127. {
  128. size_t cookie_path_len;
  129. size_t uri_path_len;
  130. char *uri_path = NULL;
  131. char *pos;
  132. bool ret = FALSE;
  133. /* cookie_path must not have last '/' separator. ex: /sample */
  134. cookie_path_len = strlen(cookie_path);
  135. if(1 == cookie_path_len) {
  136. /* cookie_path must be '/' */
  137. return TRUE;
  138. }
  139. uri_path = strdup(request_uri);
  140. if(!uri_path)
  141. return FALSE;
  142. pos = strchr(uri_path, '?');
  143. if(pos)
  144. *pos = 0x0;
  145. /* #-fragments are already cut off! */
  146. if(0 == strlen(uri_path) || uri_path[0] != '/') {
  147. strstore(&uri_path, "/", 1);
  148. if(!uri_path)
  149. return FALSE;
  150. }
  151. /*
  152. * here, RFC6265 5.1.4 says
  153. * 4. Output the characters of the uri-path from the first character up
  154. * to, but not including, the right-most %x2F ("/").
  155. * but URL path /hoge?fuga=xxx means /hoge/index.cgi?fuga=xxx in some site
  156. * without redirect.
  157. * Ignore this algorithm because /hoge is uri path for this case
  158. * (uri path is not /).
  159. */
  160. uri_path_len = strlen(uri_path);
  161. if(uri_path_len < cookie_path_len) {
  162. ret = FALSE;
  163. goto pathmatched;
  164. }
  165. /* not using checkprefix() because matching should be case-sensitive */
  166. if(strncmp(cookie_path, uri_path, cookie_path_len)) {
  167. ret = FALSE;
  168. goto pathmatched;
  169. }
  170. /* The cookie-path and the uri-path are identical. */
  171. if(cookie_path_len == uri_path_len) {
  172. ret = TRUE;
  173. goto pathmatched;
  174. }
  175. /* here, cookie_path_len < uri_path_len */
  176. if(uri_path[cookie_path_len] == '/') {
  177. ret = TRUE;
  178. goto pathmatched;
  179. }
  180. ret = FALSE;
  181. pathmatched:
  182. free(uri_path);
  183. return ret;
  184. }
  185. /*
  186. * Return the top-level domain, for optimal hashing.
  187. */
  188. static const char *get_top_domain(const char * const domain, size_t *outlen)
  189. {
  190. size_t len = 0;
  191. const char *first = NULL, *last;
  192. if(domain) {
  193. len = strlen(domain);
  194. last = memrchr(domain, '.', len);
  195. if(last) {
  196. first = memrchr(domain, '.', (last - domain));
  197. if(first)
  198. len -= (++first - domain);
  199. }
  200. }
  201. if(outlen)
  202. *outlen = len;
  203. return first? first: domain;
  204. }
  205. /* Avoid C1001, an "internal error" with MSVC14 */
  206. #if defined(_MSC_VER) && (_MSC_VER == 1900)
  207. #pragma optimize("", off)
  208. #endif
  209. /*
  210. * A case-insensitive hash for the cookie domains.
  211. */
  212. static size_t cookie_hash_domain(const char *domain, const size_t len)
  213. {
  214. const char *end = domain + len;
  215. size_t h = 5381;
  216. while(domain < end) {
  217. h += h << 5;
  218. h ^= Curl_raw_toupper(*domain++);
  219. }
  220. return (h % COOKIE_HASH_SIZE);
  221. }
  222. #if defined(_MSC_VER) && (_MSC_VER == 1900)
  223. #pragma optimize("", on)
  224. #endif
  225. /*
  226. * Hash this domain.
  227. */
  228. static size_t cookiehash(const char * const domain)
  229. {
  230. const char *top;
  231. size_t len;
  232. if(!domain || Curl_host_is_ipnum(domain))
  233. return 0;
  234. top = get_top_domain(domain, &len);
  235. return cookie_hash_domain(top, len);
  236. }
  237. /*
  238. * cookie path sanitize
  239. */
  240. static char *sanitize_cookie_path(const char *cookie_path)
  241. {
  242. size_t len;
  243. char *new_path = strdup(cookie_path);
  244. if(!new_path)
  245. return NULL;
  246. /* some stupid site sends path attribute with '"'. */
  247. len = strlen(new_path);
  248. if(new_path[0] == '\"') {
  249. memmove(new_path, new_path + 1, len);
  250. len--;
  251. }
  252. if(len && (new_path[len - 1] == '\"')) {
  253. new_path[--len] = 0x0;
  254. }
  255. /* RFC6265 5.2.4 The Path Attribute */
  256. if(new_path[0] != '/') {
  257. /* Let cookie-path be the default-path. */
  258. strstore(&new_path, "/", 1);
  259. return new_path;
  260. }
  261. /* convert /hoge/ to /hoge */
  262. if(len && new_path[len - 1] == '/') {
  263. new_path[len - 1] = 0x0;
  264. }
  265. return new_path;
  266. }
  267. /*
  268. * Load cookies from all given cookie files (CURLOPT_COOKIEFILE).
  269. *
  270. * NOTE: OOM or cookie parsing failures are ignored.
  271. */
  272. void Curl_cookie_loadfiles(struct Curl_easy *data)
  273. {
  274. struct curl_slist *list = data->state.cookielist;
  275. if(list) {
  276. Curl_share_lock(data, CURL_LOCK_DATA_COOKIE, CURL_LOCK_ACCESS_SINGLE);
  277. while(list) {
  278. struct CookieInfo *newcookies =
  279. Curl_cookie_init(data, list->data, data->cookies,
  280. data->set.cookiesession);
  281. if(!newcookies)
  282. /*
  283. * Failure may be due to OOM or a bad cookie; both are ignored
  284. * but only the first should be
  285. */
  286. infof(data, "ignoring failed cookie_init for %s", list->data);
  287. else
  288. data->cookies = newcookies;
  289. list = list->next;
  290. }
  291. Curl_share_unlock(data, CURL_LOCK_DATA_COOKIE);
  292. }
  293. }
  294. /*
  295. * strstore
  296. *
  297. * A thin wrapper around strdup which ensures that any memory allocated at
  298. * *str will be freed before the string allocated by strdup is stored there.
  299. * The intended usecase is repeated assignments to the same variable during
  300. * parsing in a last-wins scenario. The caller is responsible for checking
  301. * for OOM errors.
  302. */
  303. static void strstore(char **str, const char *newstr, size_t len)
  304. {
  305. DEBUGASSERT(newstr);
  306. DEBUGASSERT(str);
  307. free(*str);
  308. *str = Curl_memdup0(newstr, len);
  309. }
  310. /*
  311. * remove_expired
  312. *
  313. * Remove expired cookies from the hash by inspecting the expires timestamp on
  314. * each cookie in the hash, freeing and deleting any where the timestamp is in
  315. * the past. If the cookiejar has recorded the next timestamp at which one or
  316. * more cookies expire, then processing will exit early in case this timestamp
  317. * is in the future.
  318. */
  319. static void remove_expired(struct CookieInfo *cookies)
  320. {
  321. struct Cookie *co, *nx;
  322. curl_off_t now = (curl_off_t)time(NULL);
  323. unsigned int i;
  324. /*
  325. * If the earliest expiration timestamp in the jar is in the future we can
  326. * skip scanning the whole jar and instead exit early as there won't be any
  327. * cookies to evict. If we need to evict however, reset the next_expiration
  328. * counter in order to track the next one. In case the recorded first
  329. * expiration is the max offset, then perform the safe fallback of checking
  330. * all cookies.
  331. */
  332. if(now < cookies->next_expiration &&
  333. cookies->next_expiration != CURL_OFF_T_MAX)
  334. return;
  335. else
  336. cookies->next_expiration = CURL_OFF_T_MAX;
  337. for(i = 0; i < COOKIE_HASH_SIZE; i++) {
  338. struct Cookie *pv = NULL;
  339. co = cookies->cookies[i];
  340. while(co) {
  341. nx = co->next;
  342. if(co->expires && co->expires < now) {
  343. if(!pv) {
  344. cookies->cookies[i] = co->next;
  345. }
  346. else {
  347. pv->next = co->next;
  348. }
  349. cookies->numcookies--;
  350. freecookie(co);
  351. }
  352. else {
  353. /*
  354. * If this cookie has an expiration timestamp earlier than what we've
  355. * seen so far then record it for the next round of expirations.
  356. */
  357. if(co->expires && co->expires < cookies->next_expiration)
  358. cookies->next_expiration = co->expires;
  359. pv = co;
  360. }
  361. co = nx;
  362. }
  363. }
  364. }
  365. #ifndef USE_LIBPSL
  366. /* Make sure domain contains a dot or is localhost. */
  367. static bool bad_domain(const char *domain, size_t len)
  368. {
  369. if((len == 9) && strncasecompare(domain, "localhost", 9))
  370. return FALSE;
  371. else {
  372. /* there must be a dot present, but that dot must not be a trailing dot */
  373. char *dot = memchr(domain, '.', len);
  374. if(dot) {
  375. size_t i = dot - domain;
  376. if((len - i) > 1)
  377. /* the dot is not the last byte */
  378. return FALSE;
  379. }
  380. }
  381. return TRUE;
  382. }
  383. #endif
  384. /*
  385. RFC 6265 section 4.1.1 says a server should accept this range:
  386. cookie-octet = %x21 / %x23-2B / %x2D-3A / %x3C-5B / %x5D-7E
  387. But Firefox and Chrome as of June 2022 accept space, comma and double-quotes
  388. fine. The prime reason for filtering out control bytes is that some HTTP
  389. servers return 400 for requests that contain such.
  390. */
  391. static int invalid_octets(const char *p)
  392. {
  393. /* Reject all bytes \x01 - \x1f (*except* \x09, TAB) + \x7f */
  394. static const char badoctets[] = {
  395. "\x01\x02\x03\x04\x05\x06\x07\x08\x0a"
  396. "\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14"
  397. "\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x7f"
  398. };
  399. size_t len;
  400. /* scan for all the octets that are *not* in cookie-octet */
  401. len = strcspn(p, badoctets);
  402. return (p[len] != '\0');
  403. }
  404. /*
  405. * Curl_cookie_add
  406. *
  407. * Add a single cookie line to the cookie keeping object. Be aware that
  408. * sometimes we get an IP-only host name, and that might also be a numerical
  409. * IPv6 address.
  410. *
  411. * Returns NULL on out of memory or invalid cookie. This is suboptimal,
  412. * as they should be treated separately.
  413. */
  414. struct Cookie *
  415. Curl_cookie_add(struct Curl_easy *data,
  416. struct CookieInfo *c,
  417. bool httpheader, /* TRUE if HTTP header-style line */
  418. bool noexpire, /* if TRUE, skip remove_expired() */
  419. const char *lineptr, /* first character of the line */
  420. const char *domain, /* default domain */
  421. const char *path, /* full path used when this cookie is set,
  422. used to get default path for the cookie
  423. unless set */
  424. bool secure) /* TRUE if connection is over secure origin */
  425. {
  426. struct Cookie *clist;
  427. struct Cookie *co;
  428. struct Cookie *lastc = NULL;
  429. struct Cookie *replace_co = NULL;
  430. struct Cookie *replace_clist = NULL;
  431. time_t now = time(NULL);
  432. bool replace_old = FALSE;
  433. bool badcookie = FALSE; /* cookies are good by default. mmmmm yummy */
  434. size_t myhash;
  435. DEBUGASSERT(data);
  436. DEBUGASSERT(MAX_SET_COOKIE_AMOUNT <= 255); /* counter is an unsigned char */
  437. if(data->req.setcookies >= MAX_SET_COOKIE_AMOUNT)
  438. return NULL;
  439. /* First, alloc and init a new struct for it */
  440. co = calloc(1, sizeof(struct Cookie));
  441. if(!co)
  442. return NULL; /* bail out if we're this low on memory */
  443. if(httpheader) {
  444. /* This line was read off an HTTP-header */
  445. const char *ptr;
  446. size_t linelength = strlen(lineptr);
  447. if(linelength > MAX_COOKIE_LINE) {
  448. /* discard overly long lines at once */
  449. free(co);
  450. return NULL;
  451. }
  452. ptr = lineptr;
  453. do {
  454. size_t vlen;
  455. size_t nlen;
  456. while(*ptr && ISBLANK(*ptr))
  457. ptr++;
  458. /* we have a <name>=<value> pair or a stand-alone word here */
  459. nlen = strcspn(ptr, ";\t\r\n=");
  460. if(nlen) {
  461. bool done = FALSE;
  462. bool sep = FALSE;
  463. const char *namep = ptr;
  464. const char *valuep;
  465. ptr += nlen;
  466. /* trim trailing spaces and tabs after name */
  467. while(nlen && ISBLANK(namep[nlen - 1]))
  468. nlen--;
  469. if(*ptr == '=') {
  470. vlen = strcspn(++ptr, ";\r\n");
  471. valuep = ptr;
  472. sep = TRUE;
  473. ptr = &valuep[vlen];
  474. /* Strip off trailing whitespace from the value */
  475. while(vlen && ISBLANK(valuep[vlen-1]))
  476. vlen--;
  477. /* Skip leading whitespace from the value */
  478. while(vlen && ISBLANK(*valuep)) {
  479. valuep++;
  480. vlen--;
  481. }
  482. /* Reject cookies with a TAB inside the value */
  483. if(memchr(valuep, '\t', vlen)) {
  484. freecookie(co);
  485. infof(data, "cookie contains TAB, dropping");
  486. return NULL;
  487. }
  488. }
  489. else {
  490. valuep = NULL;
  491. vlen = 0;
  492. }
  493. /*
  494. * Check for too long individual name or contents, or too long
  495. * combination of name + contents. Chrome and Firefox support 4095 or
  496. * 4096 bytes combo
  497. */
  498. if(nlen >= (MAX_NAME-1) || vlen >= (MAX_NAME-1) ||
  499. ((nlen + vlen) > MAX_NAME)) {
  500. freecookie(co);
  501. infof(data, "oversized cookie dropped, name/val %zu + %zu bytes",
  502. nlen, vlen);
  503. return NULL;
  504. }
  505. /*
  506. * Check if we have a reserved prefix set before anything else, as we
  507. * otherwise have to test for the prefix in both the cookie name and
  508. * "the rest". Prefixes must start with '__' and end with a '-', so
  509. * only test for names where that can possibly be true.
  510. */
  511. if(nlen >= 7 && namep[0] == '_' && namep[1] == '_') {
  512. if(strncasecompare("__Secure-", namep, 9))
  513. co->prefix |= COOKIE_PREFIX__SECURE;
  514. else if(strncasecompare("__Host-", namep, 7))
  515. co->prefix |= COOKIE_PREFIX__HOST;
  516. }
  517. /*
  518. * Use strstore() below to properly deal with received cookie
  519. * headers that have the same string property set more than once,
  520. * and then we use the last one.
  521. */
  522. if(!co->name) {
  523. /* The very first name/value pair is the actual cookie name */
  524. if(!sep) {
  525. /* Bad name/value pair. */
  526. badcookie = TRUE;
  527. break;
  528. }
  529. strstore(&co->name, namep, nlen);
  530. strstore(&co->value, valuep, vlen);
  531. done = TRUE;
  532. if(!co->name || !co->value) {
  533. badcookie = TRUE;
  534. break;
  535. }
  536. if(invalid_octets(co->value) || invalid_octets(co->name)) {
  537. infof(data, "invalid octets in name/value, cookie dropped");
  538. badcookie = TRUE;
  539. break;
  540. }
  541. }
  542. else if(!vlen) {
  543. /*
  544. * this was a "<name>=" with no content, and we must allow
  545. * 'secure' and 'httponly' specified this weirdly
  546. */
  547. done = TRUE;
  548. /*
  549. * secure cookies are only allowed to be set when the connection is
  550. * using a secure protocol, or when the cookie is being set by
  551. * reading from file
  552. */
  553. if((nlen == 6) && strncasecompare("secure", namep, 6)) {
  554. if(secure || !c->running) {
  555. co->secure = TRUE;
  556. }
  557. else {
  558. badcookie = TRUE;
  559. break;
  560. }
  561. }
  562. else if((nlen == 8) && strncasecompare("httponly", namep, 8))
  563. co->httponly = TRUE;
  564. else if(sep)
  565. /* there was a '=' so we're not done parsing this field */
  566. done = FALSE;
  567. }
  568. if(done)
  569. ;
  570. else if((nlen == 4) && strncasecompare("path", namep, 4)) {
  571. strstore(&co->path, valuep, vlen);
  572. if(!co->path) {
  573. badcookie = TRUE; /* out of memory bad */
  574. break;
  575. }
  576. free(co->spath); /* if this is set again */
  577. co->spath = sanitize_cookie_path(co->path);
  578. if(!co->spath) {
  579. badcookie = TRUE; /* out of memory bad */
  580. break;
  581. }
  582. }
  583. else if((nlen == 6) &&
  584. strncasecompare("domain", namep, 6) && vlen) {
  585. bool is_ip;
  586. /*
  587. * Now, we make sure that our host is within the given domain, or
  588. * the given domain is not valid and thus cannot be set.
  589. */
  590. if('.' == valuep[0]) {
  591. valuep++; /* ignore preceding dot */
  592. vlen--;
  593. }
  594. #ifndef USE_LIBPSL
  595. /*
  596. * Without PSL we don't know when the incoming cookie is set on a
  597. * TLD or otherwise "protected" suffix. To reduce risk, we require a
  598. * dot OR the exact host name being "localhost".
  599. */
  600. if(bad_domain(valuep, vlen))
  601. domain = ":";
  602. #endif
  603. is_ip = Curl_host_is_ipnum(domain ? domain : valuep);
  604. if(!domain
  605. || (is_ip && !strncmp(valuep, domain, vlen) &&
  606. (vlen == strlen(domain)))
  607. || (!is_ip && cookie_tailmatch(valuep, vlen, domain))) {
  608. strstore(&co->domain, valuep, vlen);
  609. if(!co->domain) {
  610. badcookie = TRUE;
  611. break;
  612. }
  613. if(!is_ip)
  614. co->tailmatch = TRUE; /* we always do that if the domain name was
  615. given */
  616. }
  617. else {
  618. /*
  619. * We did not get a tailmatch and then the attempted set domain is
  620. * not a domain to which the current host belongs. Mark as bad.
  621. */
  622. badcookie = TRUE;
  623. infof(data, "skipped cookie with bad tailmatch domain: %s",
  624. valuep);
  625. }
  626. }
  627. else if((nlen == 7) && strncasecompare("version", namep, 7)) {
  628. /* just ignore */
  629. }
  630. else if((nlen == 7) && strncasecompare("max-age", namep, 7)) {
  631. /*
  632. * Defined in RFC2109:
  633. *
  634. * Optional. The Max-Age attribute defines the lifetime of the
  635. * cookie, in seconds. The delta-seconds value is a decimal non-
  636. * negative integer. After delta-seconds seconds elapse, the
  637. * client should discard the cookie. A value of zero means the
  638. * cookie should be discarded immediately.
  639. */
  640. CURLofft offt;
  641. const char *maxage = valuep;
  642. offt = curlx_strtoofft((*maxage == '\"')?
  643. &maxage[1]:&maxage[0], NULL, 10,
  644. &co->expires);
  645. switch(offt) {
  646. case CURL_OFFT_FLOW:
  647. /* overflow, used max value */
  648. co->expires = CURL_OFF_T_MAX;
  649. break;
  650. case CURL_OFFT_INVAL:
  651. /* negative or otherwise bad, expire */
  652. co->expires = 1;
  653. break;
  654. case CURL_OFFT_OK:
  655. if(!co->expires)
  656. /* already expired */
  657. co->expires = 1;
  658. else if(CURL_OFF_T_MAX - now < co->expires)
  659. /* would overflow */
  660. co->expires = CURL_OFF_T_MAX;
  661. else
  662. co->expires += now;
  663. break;
  664. }
  665. }
  666. else if((nlen == 7) && strncasecompare("expires", namep, 7)) {
  667. char date[128];
  668. if(!co->expires && (vlen < sizeof(date))) {
  669. /* copy the date so that it can be null terminated */
  670. memcpy(date, valuep, vlen);
  671. date[vlen] = 0;
  672. /*
  673. * Let max-age have priority.
  674. *
  675. * If the date cannot get parsed for whatever reason, the cookie
  676. * will be treated as a session cookie
  677. */
  678. co->expires = Curl_getdate_capped(date);
  679. /*
  680. * Session cookies have expires set to 0 so if we get that back
  681. * from the date parser let's add a second to make it a
  682. * non-session cookie
  683. */
  684. if(co->expires == 0)
  685. co->expires = 1;
  686. else if(co->expires < 0)
  687. co->expires = 0;
  688. }
  689. }
  690. /*
  691. * Else, this is the second (or more) name we don't know about!
  692. */
  693. }
  694. else {
  695. /* this is an "illegal" <what>=<this> pair */
  696. }
  697. while(*ptr && ISBLANK(*ptr))
  698. ptr++;
  699. if(*ptr == ';')
  700. ptr++;
  701. else
  702. break;
  703. } while(1);
  704. if(!badcookie && !co->domain) {
  705. if(domain) {
  706. /* no domain was given in the header line, set the default */
  707. co->domain = strdup(domain);
  708. if(!co->domain)
  709. badcookie = TRUE;
  710. }
  711. }
  712. if(!badcookie && !co->path && path) {
  713. /*
  714. * No path was given in the header line, set the default. Note that the
  715. * passed-in path to this function MAY have a '?' and following part that
  716. * MUST NOT be stored as part of the path.
  717. */
  718. char *queryp = strchr(path, '?');
  719. /*
  720. * queryp is where the interesting part of the path ends, so now we
  721. * want to the find the last
  722. */
  723. char *endslash;
  724. if(!queryp)
  725. endslash = strrchr(path, '/');
  726. else
  727. endslash = memrchr(path, '/', (queryp - path));
  728. if(endslash) {
  729. size_t pathlen = (endslash-path + 1); /* include end slash */
  730. co->path = Curl_memdup0(path, pathlen);
  731. if(co->path) {
  732. co->spath = sanitize_cookie_path(co->path);
  733. if(!co->spath)
  734. badcookie = TRUE; /* out of memory bad */
  735. }
  736. else
  737. badcookie = TRUE;
  738. }
  739. }
  740. /*
  741. * If we didn't get a cookie name, or a bad one, the this is an illegal
  742. * line so bail out.
  743. */
  744. if(badcookie || !co->name) {
  745. freecookie(co);
  746. return NULL;
  747. }
  748. data->req.setcookies++;
  749. }
  750. else {
  751. /*
  752. * This line is NOT an HTTP header style line, we do offer support for
  753. * reading the odd netscape cookies-file format here
  754. */
  755. char *ptr;
  756. char *firstptr;
  757. char *tok_buf = NULL;
  758. int fields;
  759. /*
  760. * IE introduced HTTP-only cookies to prevent XSS attacks. Cookies marked
  761. * with httpOnly after the domain name are not accessible from javascripts,
  762. * but since curl does not operate at javascript level, we include them
  763. * anyway. In Firefox's cookie files, these lines are preceded with
  764. * #HttpOnly_ and then everything is as usual, so we skip 10 characters of
  765. * the line..
  766. */
  767. if(strncmp(lineptr, "#HttpOnly_", 10) == 0) {
  768. lineptr += 10;
  769. co->httponly = TRUE;
  770. }
  771. if(lineptr[0]=='#') {
  772. /* don't even try the comments */
  773. free(co);
  774. return NULL;
  775. }
  776. /* strip off the possible end-of-line characters */
  777. ptr = strchr(lineptr, '\r');
  778. if(ptr)
  779. *ptr = 0; /* clear it */
  780. ptr = strchr(lineptr, '\n');
  781. if(ptr)
  782. *ptr = 0; /* clear it */
  783. firstptr = strtok_r((char *)lineptr, "\t", &tok_buf); /* tokenize on TAB */
  784. /*
  785. * Now loop through the fields and init the struct we already have
  786. * allocated
  787. */
  788. fields = 0;
  789. for(ptr = firstptr; ptr && !badcookie;
  790. ptr = strtok_r(NULL, "\t", &tok_buf), fields++) {
  791. switch(fields) {
  792. case 0:
  793. if(ptr[0]=='.') /* skip preceding dots */
  794. ptr++;
  795. co->domain = strdup(ptr);
  796. if(!co->domain)
  797. badcookie = TRUE;
  798. break;
  799. case 1:
  800. /*
  801. * flag: A TRUE/FALSE value indicating if all machines within a given
  802. * domain can access the variable. Set TRUE when the cookie says
  803. * .domain.com and to false when the domain is complete www.domain.com
  804. */
  805. co->tailmatch = strcasecompare(ptr, "TRUE")?TRUE:FALSE;
  806. break;
  807. case 2:
  808. /* The file format allows the path field to remain not filled in */
  809. if(strcmp("TRUE", ptr) && strcmp("FALSE", ptr)) {
  810. /* only if the path doesn't look like a boolean option! */
  811. co->path = strdup(ptr);
  812. if(!co->path)
  813. badcookie = TRUE;
  814. else {
  815. co->spath = sanitize_cookie_path(co->path);
  816. if(!co->spath) {
  817. badcookie = TRUE; /* out of memory bad */
  818. }
  819. }
  820. break;
  821. }
  822. /* this doesn't look like a path, make one up! */
  823. co->path = strdup("/");
  824. if(!co->path)
  825. badcookie = TRUE;
  826. co->spath = strdup("/");
  827. if(!co->spath)
  828. badcookie = TRUE;
  829. fields++; /* add a field and fall down to secure */
  830. FALLTHROUGH();
  831. case 3:
  832. co->secure = FALSE;
  833. if(strcasecompare(ptr, "TRUE")) {
  834. if(secure || c->running)
  835. co->secure = TRUE;
  836. else
  837. badcookie = TRUE;
  838. }
  839. break;
  840. case 4:
  841. if(curlx_strtoofft(ptr, NULL, 10, &co->expires))
  842. badcookie = TRUE;
  843. break;
  844. case 5:
  845. co->name = strdup(ptr);
  846. if(!co->name)
  847. badcookie = TRUE;
  848. else {
  849. /* For Netscape file format cookies we check prefix on the name */
  850. if(strncasecompare("__Secure-", co->name, 9))
  851. co->prefix |= COOKIE_PREFIX__SECURE;
  852. else if(strncasecompare("__Host-", co->name, 7))
  853. co->prefix |= COOKIE_PREFIX__HOST;
  854. }
  855. break;
  856. case 6:
  857. co->value = strdup(ptr);
  858. if(!co->value)
  859. badcookie = TRUE;
  860. break;
  861. }
  862. }
  863. if(6 == fields) {
  864. /* we got a cookie with blank contents, fix it */
  865. co->value = strdup("");
  866. if(!co->value)
  867. badcookie = TRUE;
  868. else
  869. fields++;
  870. }
  871. if(!badcookie && (7 != fields))
  872. /* we did not find the sufficient number of fields */
  873. badcookie = TRUE;
  874. if(badcookie) {
  875. freecookie(co);
  876. return NULL;
  877. }
  878. }
  879. if(co->prefix & COOKIE_PREFIX__SECURE) {
  880. /* The __Secure- prefix only requires that the cookie be set secure */
  881. if(!co->secure) {
  882. freecookie(co);
  883. return NULL;
  884. }
  885. }
  886. if(co->prefix & COOKIE_PREFIX__HOST) {
  887. /*
  888. * The __Host- prefix requires the cookie to be secure, have a "/" path
  889. * and not have a domain set.
  890. */
  891. if(co->secure && co->path && strcmp(co->path, "/") == 0 && !co->tailmatch)
  892. ;
  893. else {
  894. freecookie(co);
  895. return NULL;
  896. }
  897. }
  898. if(!c->running && /* read from a file */
  899. c->newsession && /* clean session cookies */
  900. !co->expires) { /* this is a session cookie since it doesn't expire! */
  901. freecookie(co);
  902. return NULL;
  903. }
  904. co->livecookie = c->running;
  905. co->creationtime = ++c->lastct;
  906. /*
  907. * Now we have parsed the incoming line, we must now check if this supersedes
  908. * an already existing cookie, which it may if the previous have the same
  909. * domain and path as this.
  910. */
  911. /* at first, remove expired cookies */
  912. if(!noexpire)
  913. remove_expired(c);
  914. #ifdef USE_LIBPSL
  915. /*
  916. * Check if the domain is a Public Suffix and if yes, ignore the cookie. We
  917. * must also check that the data handle isn't NULL since the psl code will
  918. * dereference it.
  919. */
  920. if(data && (domain && co->domain && !Curl_host_is_ipnum(co->domain))) {
  921. bool acceptable = FALSE;
  922. char lcase[256];
  923. char lcookie[256];
  924. size_t dlen = strlen(domain);
  925. size_t clen = strlen(co->domain);
  926. if((dlen < sizeof(lcase)) && (clen < sizeof(lcookie))) {
  927. const psl_ctx_t *psl = Curl_psl_use(data);
  928. if(psl) {
  929. /* the PSL check requires lowercase domain name and pattern */
  930. Curl_strntolower(lcase, domain, dlen + 1);
  931. Curl_strntolower(lcookie, co->domain, clen + 1);
  932. acceptable = psl_is_cookie_domain_acceptable(psl, lcase, lcookie);
  933. Curl_psl_release(data);
  934. }
  935. else
  936. infof(data, "libpsl problem, rejecting cookie for satety");
  937. }
  938. if(!acceptable) {
  939. infof(data, "cookie '%s' dropped, domain '%s' must not "
  940. "set cookies for '%s'", co->name, domain, co->domain);
  941. freecookie(co);
  942. return NULL;
  943. }
  944. }
  945. #endif
  946. /* A non-secure cookie may not overlay an existing secure cookie. */
  947. myhash = cookiehash(co->domain);
  948. clist = c->cookies[myhash];
  949. while(clist) {
  950. if(strcasecompare(clist->name, co->name)) {
  951. /* the names are identical */
  952. bool matching_domains = FALSE;
  953. if(clist->domain && co->domain) {
  954. if(strcasecompare(clist->domain, co->domain))
  955. /* The domains are identical */
  956. matching_domains = TRUE;
  957. }
  958. else if(!clist->domain && !co->domain)
  959. matching_domains = TRUE;
  960. if(matching_domains && /* the domains were identical */
  961. clist->spath && co->spath && /* both have paths */
  962. clist->secure && !co->secure && !secure) {
  963. size_t cllen;
  964. const char *sep;
  965. /*
  966. * A non-secure cookie may not overlay an existing secure cookie.
  967. * For an existing cookie "a" with path "/login", refuse a new
  968. * cookie "a" with for example path "/login/en", while the path
  969. * "/loginhelper" is ok.
  970. */
  971. sep = strchr(clist->spath + 1, '/');
  972. if(sep)
  973. cllen = sep - clist->spath;
  974. else
  975. cllen = strlen(clist->spath);
  976. if(strncasecompare(clist->spath, co->spath, cllen)) {
  977. infof(data, "cookie '%s' for domain '%s' dropped, would "
  978. "overlay an existing cookie", co->name, co->domain);
  979. freecookie(co);
  980. return NULL;
  981. }
  982. }
  983. }
  984. if(!replace_co && strcasecompare(clist->name, co->name)) {
  985. /* the names are identical */
  986. if(clist->domain && co->domain) {
  987. if(strcasecompare(clist->domain, co->domain) &&
  988. (clist->tailmatch == co->tailmatch))
  989. /* The domains are identical */
  990. replace_old = TRUE;
  991. }
  992. else if(!clist->domain && !co->domain)
  993. replace_old = TRUE;
  994. if(replace_old) {
  995. /* the domains were identical */
  996. if(clist->spath && co->spath &&
  997. !strcasecompare(clist->spath, co->spath))
  998. replace_old = FALSE;
  999. else if(!clist->spath != !co->spath)
  1000. replace_old = FALSE;
  1001. }
  1002. if(replace_old && !co->livecookie && clist->livecookie) {
  1003. /*
  1004. * Both cookies matched fine, except that the already present cookie is
  1005. * "live", which means it was set from a header, while the new one was
  1006. * read from a file and thus isn't "live". "live" cookies are preferred
  1007. * so the new cookie is freed.
  1008. */
  1009. freecookie(co);
  1010. return NULL;
  1011. }
  1012. if(replace_old) {
  1013. replace_co = co;
  1014. replace_clist = clist;
  1015. }
  1016. }
  1017. lastc = clist;
  1018. clist = clist->next;
  1019. }
  1020. if(replace_co) {
  1021. co = replace_co;
  1022. clist = replace_clist;
  1023. co->next = clist->next; /* get the next-pointer first */
  1024. /* when replacing, creationtime is kept from old */
  1025. co->creationtime = clist->creationtime;
  1026. /* then free all the old pointers */
  1027. free(clist->name);
  1028. free(clist->value);
  1029. free(clist->domain);
  1030. free(clist->path);
  1031. free(clist->spath);
  1032. *clist = *co; /* then store all the new data */
  1033. free(co); /* free the newly allocated memory */
  1034. co = clist;
  1035. }
  1036. if(c->running)
  1037. /* Only show this when NOT reading the cookies from a file */
  1038. infof(data, "%s cookie %s=\"%s\" for domain %s, path %s, "
  1039. "expire %" CURL_FORMAT_CURL_OFF_T,
  1040. replace_old?"Replaced":"Added", co->name, co->value,
  1041. co->domain, co->path, co->expires);
  1042. if(!replace_old) {
  1043. /* then make the last item point on this new one */
  1044. if(lastc)
  1045. lastc->next = co;
  1046. else
  1047. c->cookies[myhash] = co;
  1048. c->numcookies++; /* one more cookie in the jar */
  1049. }
  1050. /*
  1051. * Now that we've added a new cookie to the jar, update the expiration
  1052. * tracker in case it is the next one to expire.
  1053. */
  1054. if(co->expires && (co->expires < c->next_expiration))
  1055. c->next_expiration = co->expires;
  1056. return co;
  1057. }
  1058. /*
  1059. * Curl_cookie_init()
  1060. *
  1061. * Inits a cookie struct to read data from a local file. This is always
  1062. * called before any cookies are set. File may be NULL in which case only the
  1063. * struct is initialized. Is file is "-" then STDIN is read.
  1064. *
  1065. * If 'newsession' is TRUE, discard all "session cookies" on read from file.
  1066. *
  1067. * Note that 'data' might be called as NULL pointer. If data is NULL, 'file'
  1068. * will be ignored.
  1069. *
  1070. * Returns NULL on out of memory. Invalid cookies are ignored.
  1071. */
  1072. struct CookieInfo *Curl_cookie_init(struct Curl_easy *data,
  1073. const char *file,
  1074. struct CookieInfo *inc,
  1075. bool newsession)
  1076. {
  1077. struct CookieInfo *c;
  1078. FILE *handle = NULL;
  1079. if(!inc) {
  1080. /* we didn't get a struct, create one */
  1081. c = calloc(1, sizeof(struct CookieInfo));
  1082. if(!c)
  1083. return NULL; /* failed to get memory */
  1084. /*
  1085. * Initialize the next_expiration time to signal that we don't have enough
  1086. * information yet.
  1087. */
  1088. c->next_expiration = CURL_OFF_T_MAX;
  1089. }
  1090. else {
  1091. /* we got an already existing one, use that */
  1092. c = inc;
  1093. }
  1094. c->newsession = newsession; /* new session? */
  1095. if(data) {
  1096. FILE *fp = NULL;
  1097. if(file && *file) {
  1098. if(!strcmp(file, "-"))
  1099. fp = stdin;
  1100. else {
  1101. fp = fopen(file, "rb");
  1102. if(!fp)
  1103. infof(data, "WARNING: failed to open cookie file \"%s\"", file);
  1104. else
  1105. handle = fp;
  1106. }
  1107. }
  1108. c->running = FALSE; /* this is not running, this is init */
  1109. if(fp) {
  1110. struct dynbuf buf;
  1111. Curl_dyn_init(&buf, MAX_COOKIE_LINE);
  1112. while(Curl_get_line(&buf, fp)) {
  1113. char *lineptr = Curl_dyn_ptr(&buf);
  1114. bool headerline = FALSE;
  1115. if(checkprefix("Set-Cookie:", lineptr)) {
  1116. /* This is a cookie line, get it! */
  1117. lineptr += 11;
  1118. headerline = TRUE;
  1119. while(*lineptr && ISBLANK(*lineptr))
  1120. lineptr++;
  1121. }
  1122. Curl_cookie_add(data, c, headerline, TRUE, lineptr, NULL, NULL, TRUE);
  1123. }
  1124. Curl_dyn_free(&buf); /* free the line buffer */
  1125. /*
  1126. * Remove expired cookies from the hash. We must make sure to run this
  1127. * after reading the file, and not on every cookie.
  1128. */
  1129. remove_expired(c);
  1130. if(handle)
  1131. fclose(handle);
  1132. }
  1133. data->state.cookie_engine = TRUE;
  1134. }
  1135. c->running = TRUE; /* now, we're running */
  1136. return c;
  1137. }
  1138. /*
  1139. * cookie_sort
  1140. *
  1141. * Helper function to sort cookies such that the longest path gets before the
  1142. * shorter path. Path, domain and name lengths are considered in that order,
  1143. * with the creationtime as the tiebreaker. The creationtime is guaranteed to
  1144. * be unique per cookie, so we know we will get an ordering at that point.
  1145. */
  1146. static int cookie_sort(const void *p1, const void *p2)
  1147. {
  1148. struct Cookie *c1 = *(struct Cookie **)p1;
  1149. struct Cookie *c2 = *(struct Cookie **)p2;
  1150. size_t l1, l2;
  1151. /* 1 - compare cookie path lengths */
  1152. l1 = c1->path ? strlen(c1->path) : 0;
  1153. l2 = c2->path ? strlen(c2->path) : 0;
  1154. if(l1 != l2)
  1155. return (l2 > l1) ? 1 : -1 ; /* avoid size_t <=> int conversions */
  1156. /* 2 - compare cookie domain lengths */
  1157. l1 = c1->domain ? strlen(c1->domain) : 0;
  1158. l2 = c2->domain ? strlen(c2->domain) : 0;
  1159. if(l1 != l2)
  1160. return (l2 > l1) ? 1 : -1 ; /* avoid size_t <=> int conversions */
  1161. /* 3 - compare cookie name lengths */
  1162. l1 = c1->name ? strlen(c1->name) : 0;
  1163. l2 = c2->name ? strlen(c2->name) : 0;
  1164. if(l1 != l2)
  1165. return (l2 > l1) ? 1 : -1;
  1166. /* 4 - compare cookie creation time */
  1167. return (c2->creationtime > c1->creationtime) ? 1 : -1;
  1168. }
  1169. /*
  1170. * cookie_sort_ct
  1171. *
  1172. * Helper function to sort cookies according to creation time.
  1173. */
  1174. static int cookie_sort_ct(const void *p1, const void *p2)
  1175. {
  1176. struct Cookie *c1 = *(struct Cookie **)p1;
  1177. struct Cookie *c2 = *(struct Cookie **)p2;
  1178. return (c2->creationtime > c1->creationtime) ? 1 : -1;
  1179. }
  1180. #define CLONE(field) \
  1181. do { \
  1182. if(src->field) { \
  1183. d->field = strdup(src->field); \
  1184. if(!d->field) \
  1185. goto fail; \
  1186. } \
  1187. } while(0)
  1188. static struct Cookie *dup_cookie(struct Cookie *src)
  1189. {
  1190. struct Cookie *d = calloc(1, sizeof(struct Cookie));
  1191. if(d) {
  1192. CLONE(domain);
  1193. CLONE(path);
  1194. CLONE(spath);
  1195. CLONE(name);
  1196. CLONE(value);
  1197. d->expires = src->expires;
  1198. d->tailmatch = src->tailmatch;
  1199. d->secure = src->secure;
  1200. d->livecookie = src->livecookie;
  1201. d->httponly = src->httponly;
  1202. d->creationtime = src->creationtime;
  1203. }
  1204. return d;
  1205. fail:
  1206. freecookie(d);
  1207. return NULL;
  1208. }
  1209. /*
  1210. * Curl_cookie_getlist
  1211. *
  1212. * For a given host and path, return a linked list of cookies that the client
  1213. * should send to the server if used now. The secure boolean informs the cookie
  1214. * if a secure connection is achieved or not.
  1215. *
  1216. * It shall only return cookies that haven't expired.
  1217. */
  1218. struct Cookie *Curl_cookie_getlist(struct Curl_easy *data,
  1219. struct CookieInfo *c,
  1220. const char *host, const char *path,
  1221. bool secure)
  1222. {
  1223. struct Cookie *newco;
  1224. struct Cookie *co;
  1225. struct Cookie *mainco = NULL;
  1226. size_t matches = 0;
  1227. bool is_ip;
  1228. const size_t myhash = cookiehash(host);
  1229. if(!c || !c->cookies[myhash])
  1230. return NULL; /* no cookie struct or no cookies in the struct */
  1231. /* at first, remove expired cookies */
  1232. remove_expired(c);
  1233. /* check if host is an IP(v4|v6) address */
  1234. is_ip = Curl_host_is_ipnum(host);
  1235. co = c->cookies[myhash];
  1236. while(co) {
  1237. /* if the cookie requires we're secure we must only continue if we are! */
  1238. if(co->secure?secure:TRUE) {
  1239. /* now check if the domain is correct */
  1240. if(!co->domain ||
  1241. (co->tailmatch && !is_ip &&
  1242. cookie_tailmatch(co->domain, strlen(co->domain), host)) ||
  1243. ((!co->tailmatch || is_ip) && strcasecompare(host, co->domain)) ) {
  1244. /*
  1245. * the right part of the host matches the domain stuff in the
  1246. * cookie data
  1247. */
  1248. /*
  1249. * now check the left part of the path with the cookies path
  1250. * requirement
  1251. */
  1252. if(!co->spath || pathmatch(co->spath, path) ) {
  1253. /*
  1254. * and now, we know this is a match and we should create an
  1255. * entry for the return-linked-list
  1256. */
  1257. newco = dup_cookie(co);
  1258. if(newco) {
  1259. /* then modify our next */
  1260. newco->next = mainco;
  1261. /* point the main to us */
  1262. mainco = newco;
  1263. matches++;
  1264. if(matches >= MAX_COOKIE_SEND_AMOUNT) {
  1265. infof(data, "Included max number of cookies (%zu) in request!",
  1266. matches);
  1267. break;
  1268. }
  1269. }
  1270. else
  1271. goto fail;
  1272. }
  1273. }
  1274. }
  1275. co = co->next;
  1276. }
  1277. if(matches) {
  1278. /*
  1279. * Now we need to make sure that if there is a name appearing more than
  1280. * once, the longest specified path version comes first. To make this
  1281. * the swiftest way, we just sort them all based on path length.
  1282. */
  1283. struct Cookie **array;
  1284. size_t i;
  1285. /* alloc an array and store all cookie pointers */
  1286. array = malloc(sizeof(struct Cookie *) * matches);
  1287. if(!array)
  1288. goto fail;
  1289. co = mainco;
  1290. for(i = 0; co; co = co->next)
  1291. array[i++] = co;
  1292. /* now sort the cookie pointers in path length order */
  1293. qsort(array, matches, sizeof(struct Cookie *), cookie_sort);
  1294. /* remake the linked list order according to the new order */
  1295. mainco = array[0]; /* start here */
  1296. for(i = 0; i<matches-1; i++)
  1297. array[i]->next = array[i + 1];
  1298. array[matches-1]->next = NULL; /* terminate the list */
  1299. free(array); /* remove the temporary data again */
  1300. }
  1301. return mainco; /* return the new list */
  1302. fail:
  1303. /* failure, clear up the allocated chain and return NULL */
  1304. Curl_cookie_freelist(mainco);
  1305. return NULL;
  1306. }
  1307. /*
  1308. * Curl_cookie_clearall
  1309. *
  1310. * Clear all existing cookies and reset the counter.
  1311. */
  1312. void Curl_cookie_clearall(struct CookieInfo *cookies)
  1313. {
  1314. if(cookies) {
  1315. unsigned int i;
  1316. for(i = 0; i < COOKIE_HASH_SIZE; i++) {
  1317. Curl_cookie_freelist(cookies->cookies[i]);
  1318. cookies->cookies[i] = NULL;
  1319. }
  1320. cookies->numcookies = 0;
  1321. }
  1322. }
  1323. /*
  1324. * Curl_cookie_freelist
  1325. *
  1326. * Free a list of cookies previously returned by Curl_cookie_getlist();
  1327. */
  1328. void Curl_cookie_freelist(struct Cookie *co)
  1329. {
  1330. struct Cookie *next;
  1331. while(co) {
  1332. next = co->next;
  1333. freecookie(co);
  1334. co = next;
  1335. }
  1336. }
  1337. /*
  1338. * Curl_cookie_clearsess
  1339. *
  1340. * Free all session cookies in the cookies list.
  1341. */
  1342. void Curl_cookie_clearsess(struct CookieInfo *cookies)
  1343. {
  1344. struct Cookie *first, *curr, *next, *prev = NULL;
  1345. unsigned int i;
  1346. if(!cookies)
  1347. return;
  1348. for(i = 0; i < COOKIE_HASH_SIZE; i++) {
  1349. if(!cookies->cookies[i])
  1350. continue;
  1351. first = curr = prev = cookies->cookies[i];
  1352. for(; curr; curr = next) {
  1353. next = curr->next;
  1354. if(!curr->expires) {
  1355. if(first == curr)
  1356. first = next;
  1357. if(prev == curr)
  1358. prev = next;
  1359. else
  1360. prev->next = next;
  1361. freecookie(curr);
  1362. cookies->numcookies--;
  1363. }
  1364. else
  1365. prev = curr;
  1366. }
  1367. cookies->cookies[i] = first;
  1368. }
  1369. }
  1370. /*
  1371. * Curl_cookie_cleanup()
  1372. *
  1373. * Free a "cookie object" previous created with Curl_cookie_init().
  1374. */
  1375. void Curl_cookie_cleanup(struct CookieInfo *c)
  1376. {
  1377. if(c) {
  1378. unsigned int i;
  1379. for(i = 0; i < COOKIE_HASH_SIZE; i++)
  1380. Curl_cookie_freelist(c->cookies[i]);
  1381. free(c); /* free the base struct as well */
  1382. }
  1383. }
  1384. /*
  1385. * get_netscape_format()
  1386. *
  1387. * Formats a string for Netscape output file, w/o a newline at the end.
  1388. * Function returns a char * to a formatted line. The caller is responsible
  1389. * for freeing the returned pointer.
  1390. */
  1391. static char *get_netscape_format(const struct Cookie *co)
  1392. {
  1393. return aprintf(
  1394. "%s" /* httponly preamble */
  1395. "%s%s\t" /* domain */
  1396. "%s\t" /* tailmatch */
  1397. "%s\t" /* path */
  1398. "%s\t" /* secure */
  1399. "%" CURL_FORMAT_CURL_OFF_T "\t" /* expires */
  1400. "%s\t" /* name */
  1401. "%s", /* value */
  1402. co->httponly?"#HttpOnly_":"",
  1403. /*
  1404. * Make sure all domains are prefixed with a dot if they allow
  1405. * tailmatching. This is Mozilla-style.
  1406. */
  1407. (co->tailmatch && co->domain && co->domain[0] != '.')? ".":"",
  1408. co->domain?co->domain:"unknown",
  1409. co->tailmatch?"TRUE":"FALSE",
  1410. co->path?co->path:"/",
  1411. co->secure?"TRUE":"FALSE",
  1412. co->expires,
  1413. co->name,
  1414. co->value?co->value:"");
  1415. }
  1416. /*
  1417. * cookie_output()
  1418. *
  1419. * Writes all internally known cookies to the specified file. Specify
  1420. * "-" as file name to write to stdout.
  1421. *
  1422. * The function returns non-zero on write failure.
  1423. */
  1424. static CURLcode cookie_output(struct Curl_easy *data,
  1425. struct CookieInfo *c, const char *filename)
  1426. {
  1427. struct Cookie *co;
  1428. FILE *out = NULL;
  1429. bool use_stdout = FALSE;
  1430. char *tempstore = NULL;
  1431. CURLcode error = CURLE_OK;
  1432. if(!c)
  1433. /* no cookie engine alive */
  1434. return CURLE_OK;
  1435. /* at first, remove expired cookies */
  1436. remove_expired(c);
  1437. if(!strcmp("-", filename)) {
  1438. /* use stdout */
  1439. out = stdout;
  1440. use_stdout = TRUE;
  1441. }
  1442. else {
  1443. error = Curl_fopen(data, filename, &out, &tempstore);
  1444. if(error)
  1445. goto error;
  1446. }
  1447. fputs("# Netscape HTTP Cookie File\n"
  1448. "# https://curl.se/docs/http-cookies.html\n"
  1449. "# This file was generated by libcurl! Edit at your own risk.\n\n",
  1450. out);
  1451. if(c->numcookies) {
  1452. unsigned int i;
  1453. size_t nvalid = 0;
  1454. struct Cookie **array;
  1455. array = calloc(1, sizeof(struct Cookie *) * c->numcookies);
  1456. if(!array) {
  1457. error = CURLE_OUT_OF_MEMORY;
  1458. goto error;
  1459. }
  1460. /* only sort the cookies with a domain property */
  1461. for(i = 0; i < COOKIE_HASH_SIZE; i++) {
  1462. for(co = c->cookies[i]; co; co = co->next) {
  1463. if(!co->domain)
  1464. continue;
  1465. array[nvalid++] = co;
  1466. }
  1467. }
  1468. qsort(array, nvalid, sizeof(struct Cookie *), cookie_sort_ct);
  1469. for(i = 0; i < nvalid; i++) {
  1470. char *format_ptr = get_netscape_format(array[i]);
  1471. if(!format_ptr) {
  1472. free(array);
  1473. error = CURLE_OUT_OF_MEMORY;
  1474. goto error;
  1475. }
  1476. fprintf(out, "%s\n", format_ptr);
  1477. free(format_ptr);
  1478. }
  1479. free(array);
  1480. }
  1481. if(!use_stdout) {
  1482. fclose(out);
  1483. out = NULL;
  1484. if(tempstore && Curl_rename(tempstore, filename)) {
  1485. unlink(tempstore);
  1486. error = CURLE_WRITE_ERROR;
  1487. goto error;
  1488. }
  1489. }
  1490. /*
  1491. * If we reach here we have successfully written a cookie file so there is
  1492. * no need to inspect the error, any error case should have jumped into the
  1493. * error block below.
  1494. */
  1495. free(tempstore);
  1496. return CURLE_OK;
  1497. error:
  1498. if(out && !use_stdout)
  1499. fclose(out);
  1500. free(tempstore);
  1501. return error;
  1502. }
  1503. static struct curl_slist *cookie_list(struct Curl_easy *data)
  1504. {
  1505. struct curl_slist *list = NULL;
  1506. struct curl_slist *beg;
  1507. struct Cookie *c;
  1508. char *line;
  1509. unsigned int i;
  1510. if(!data->cookies || (data->cookies->numcookies == 0))
  1511. return NULL;
  1512. for(i = 0; i < COOKIE_HASH_SIZE; i++) {
  1513. for(c = data->cookies->cookies[i]; c; c = c->next) {
  1514. if(!c->domain)
  1515. continue;
  1516. line = get_netscape_format(c);
  1517. if(!line) {
  1518. curl_slist_free_all(list);
  1519. return NULL;
  1520. }
  1521. beg = Curl_slist_append_nodup(list, line);
  1522. if(!beg) {
  1523. free(line);
  1524. curl_slist_free_all(list);
  1525. return NULL;
  1526. }
  1527. list = beg;
  1528. }
  1529. }
  1530. return list;
  1531. }
  1532. struct curl_slist *Curl_cookie_list(struct Curl_easy *data)
  1533. {
  1534. struct curl_slist *list;
  1535. Curl_share_lock(data, CURL_LOCK_DATA_COOKIE, CURL_LOCK_ACCESS_SINGLE);
  1536. list = cookie_list(data);
  1537. Curl_share_unlock(data, CURL_LOCK_DATA_COOKIE);
  1538. return list;
  1539. }
  1540. void Curl_flush_cookies(struct Curl_easy *data, bool cleanup)
  1541. {
  1542. CURLcode res;
  1543. if(data->set.str[STRING_COOKIEJAR]) {
  1544. Curl_share_lock(data, CURL_LOCK_DATA_COOKIE, CURL_LOCK_ACCESS_SINGLE);
  1545. /* if we have a destination file for all the cookies to get dumped to */
  1546. res = cookie_output(data, data->cookies, data->set.str[STRING_COOKIEJAR]);
  1547. if(res)
  1548. infof(data, "WARNING: failed to save cookies in %s: %s",
  1549. data->set.str[STRING_COOKIEJAR], curl_easy_strerror(res));
  1550. }
  1551. else {
  1552. Curl_share_lock(data, CURL_LOCK_DATA_COOKIE, CURL_LOCK_ACCESS_SINGLE);
  1553. }
  1554. if(cleanup && (!data->share || (data->cookies != data->share->cookies))) {
  1555. Curl_cookie_cleanup(data->cookies);
  1556. data->cookies = NULL;
  1557. }
  1558. Curl_share_unlock(data, CURL_LOCK_DATA_COOKIE);
  1559. }
  1560. #endif /* CURL_DISABLE_HTTP || CURL_DISABLE_COOKIES */