arachni 0.4.7 → 1.0

data/lib/arachni/element/cookie.rb

@@ -1,212 +1,138 @@
 =begin
-    Copyright 2010-2014 Tasos Laskos <tasos.laskos@gmail.com>
+    Copyright 2010-2014 Tasos Laskos <tasos.laskos@arachni-scanner.com>
 
-    Licensed under the Apache License, Version 2.0 (the "License");
-    you may not use this file except in compliance with the License.
-    You may obtain a copy of the License at
-
-        http://www.apache.org/licenses/LICENSE-2.0
-
-    Unless required by applicable law or agreed to in writing, software
-    distributed under the License is distributed on an "AS IS" BASIS,
-    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-    See the License for the specific language governing permissions and
-    limitations under the License.
+    This file is part of the Arachni Framework project and is subject to
+    redistribution and commercial restrictions. Please see the Arachni Framework
+    web site for more information on licensing and terms of use.
 =end
 
 require 'webrick'
 require 'uri'
 
-require Arachni::Options.dir['lib'] + 'element/base'
+require_relative 'base'
 
 module Arachni::Element
 
-COOKIE = 'cookie'
-
-#
-# Represents a Cookie object and provides helper class methods for parsing, encoding, etc.
+# Represents a Cookie object and provides helper class methods for parsing,
+# encoding, etc.
 #
-# @author Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
-#
-class Cookie < Arachni::Element::Base
+# @author Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
+class Cookie < Base
+    require_relative 'cookie/dom'
+
+    include Capabilities::WithDOM
+    include Capabilities::Analyzable
 
-    #
     # Default cookie values
-    #
     DEFAULT = {
-           "name" => nil,
-          "value" => nil,
-        "version" => 0,
-           "port" => nil,
-        "discard" => nil,
-    "comment_url" => nil,
-        "expires" => nil,
-        "max_age" => nil,
-        "comment" => nil,
-         "secure" => nil,
-           "path" => nil,
-         "domain" => nil,
-       "httponly" => false
+        name:        nil,
+        value:       nil,
+        version:     0,
+        port:        nil,
+        discard:     nil,
+        comment_url: nil,
+        expires:     nil,
+        max_age:     nil,
+        comment:     nil,
+        secure:      nil,
+        path:        nil,
+        domain:      nil,
+        httponly:    false
     }
 
-    def initialize( url, raw = {} )
-        super( url, raw )
-
-        self.action = @url
-        self.method = 'get'
-
-        @raw ||= {}
-        if @raw['name'] && @raw['value']
-            self.auditable = { @raw['name'].to_s.recode => @raw['value'].to_s.recode }
+    # @param    [Hash]  options
+    #   For options see {DEFAULT}, with the following extras:
+    # @option   options [String]    :url
+    #   URL of the page which created the cookie -- **required**.
+    # @option   options [String]     :action
+    #   URL of the page to submit the cookie -- defaults to `:url`.
+    # @option   options [Hash]     :inputs
+    #   Allows you to pass cookie data as a `name => value` pair instead of the
+    #   more complex {DEFAULT} structure.
+    def initialize( options )
+        @data = {}
+        super( options )
+
+        if options[:name] && options[:value]
+            options[:name]  = options[:name].to_s.recode
+            options[:value] = options[:value].to_s.recode
+
+            self.inputs = { options[:name] => options[:value] }
+            @data.merge!( options )
         else
-            self.auditable = raw.dup
+            self.inputs = (options[:inputs] || {}).dup
         end
 
-        @raw = @raw.merge( DEFAULT.merge( @raw ) )
-        if @raw['value'] && !@raw['value'].empty?
-            @raw['value'] = decode( @raw['value'].to_s )
-        end
+        @data.merge!( DEFAULT.merge( @data ) )
+        @data[:value] = decode( @data[:value].to_s )
 
-        parsed_uri = uri_parse( @url )
-        if !@raw['path']
+        parsed_uri = uri_parse( action )
+        if !@data[:path]
             path = parsed_uri.path
             path = !path.empty? ? path : '/'
-            @raw['path'] = path
+            @data[:path] = path
         end
 
-        @raw['domain'] ||= parsed_uri.host
+        if @data[:expires] && !@data[:expires].is_a?( Time )
+            @data[:expires] = Time.parse( @data[:expires] ) rescue nil
+        end
 
-        @raw['max_age'] = @raw['max_age'] if @raw['max_age']
+        @data[:domain] ||= ".#{parsed_uri.host}"
 
-        @orig   = self.auditable.dup
-        @orig.freeze
+        @default_inputs = self.inputs.dup.freeze
     end
 
-    #
-    # Overrides {Capabilities::Auditable#audit} to enforce cookie exclusion
-    # settings from {Arachni::Options#exclude_cookies}.
-    #
-    # @see Capabilities::Auditable#audit
-    #
-    def audit( *args )
-        if Arachni::Options.exclude_cookies.include?( name )
-            auditor.print_info "Skipping audit of '#{name}' cookie."
-            return
-        end
-        super( *args )
+    # @return   [DOM]
+    def dom
+        return if @skip_dom || inputs.empty?
+
+        # In case the cookie already has input data not supported by its DOM
+        # extension.
+        @skip_dom = !try_input { super }
+
+        @dom
     end
 
-    #
     # Indicates whether the cookie must be only sent over an encrypted channel.
     #
-    # @example
-    #    p Cookie.from_set_cookie( 'http://owner-url.com', 'session=stuffstuffstuff; secure' ).first.secure?
-    #    #=> true
-    #
-    #    p Cookie.from_set_cookie( 'http://owner-url.com', 'session=stuffstuffstuff' ).first.secure?
-    #    #=> false
-    #
     # @return   [Bool]
-    #
     def secure?
-        @raw['secure'] == true
+        @data[:secure] == true
     end
 
-    #
     # Indicates whether the cookie is safe from modification from client-side code.
     #
-    # @example
-    #    p Cookie.from_set_cookie( 'http://owner-url.com', 'session=stuffstuffstuff; httpOnly' ).first.http_only?
-    #    #=> true
-    #
-    #    p Cookie.from_set_cookie( 'http://owner-url.com', 'session=stuffstuffstuff' ).first.http_only?
-    #    #=> false
-    #
     # @return   [Bool]
-    #
     def http_only?
-        @raw['httponly'] == true
+        @data[:httponly] == true
     end
 
-    #
     # Indicates whether the cookie is to be discarded at the end of the session.
     #
-    # Doesn't play a role during the scan but it can provide useful info to modules and such.
-    #
-    # @example
-    #    # doesn't have an expiration date, i.e. it should be discarded at the end of the session
-    #    p Cookie.from_set_cookie( 'http://owner-url.com', 'session=stuffstuffstuff' ).first.session?
-    #    #=> true
-    #
-    #    # does have an expiration date, i.e. not a session cookie
-    #    p Cookie.from_set_cookie( 'http://owner-url.com', 'session=stuffstuffstuff; Expires=Thu, 01 Jan 1970 00:00:01 GMT' ).first.session?
-    #    #=> false
+    # Doesn't play a role during the scan but it can provide useful info to checks and such.
     #
     # @return   [Bool]
-    #
     def session?
-        @raw['expires'].nil?
+        @data[:expires].nil?
     end
 
-    #
-    # @example
-    #    p Cookie.from_set_cookie( 'http://owner-url.com', 'session=stuffstuffstuff' ).first.expires_at
-    #    #=> nil
-    #
-    #    p Cookie.from_set_cookie( 'http://owner-url.com', 'session=stuffstuffstuff; Expires=Thu, 01 Jan 1970 00:00:01 GMT' ).first.expires_at
-    #    #=> 1970-01-01 02:00:01 +0200
-    #
-    #
     # @return   [Time, NilClass]
     #   Expiration `Time` of the cookie or `nil` if it doesn't have one
     #   (i.e. is a session cookie).
-    #
     def expires_at
-        expires
+        @data[:expires]
     end
 
-    #
     # Indicates whether or not the cookie has expired.
     #
-    # @example Without a time argument.
-    #
-    #    # session cookie
-    #    p Cookie.from_set_cookie( 'http://owner-url.com', 'session=stuffstuffstuff' ).first.expired?
-    #    #=> false
-    #
-    #    # cookie with the expiration date in the future
-    #    p Cookie.from_set_cookie( 'http://owner-url.com', 'session=stuffstuffstuff; Expires=Thu, 01 Jan 2020 00:00:01 GMT' ).first.expired?
-    #    #=> true
-    #
-    #    # expired cookie
-    #    p Cookie.from_set_cookie( 'http://owner-url.com', 'session=stuffstuffstuff; Expires=Thu, 01 Jan 1970 00:00:01 GMT' ).first.expired?
-    #    #=> true
-    #
-    # @example With a time argument.
-    #
-    #    future_time = Cookie.expires_to_time( 'Thu, 01 Jan 2021 00:00:01 GMT' )
-    #
-    #    # session cookie
-    #    p Cookie.from_set_cookie( 'http://owner-url.com', 'session=stuffstuffstuff' ).first.expired?( future_time )
-    #    #=> false
-    #
-    #    # cookie with the expiration date in the future
-    #    p Cookie.from_set_cookie( 'http://owner-url.com', 'session=stuffstuffstuff; Expires=Thu, 01 Jan 2020 00:00:01 GMT' ).first.expired?( future_time )
-    #    #=> true
-    #
-    #    # expired cookie
-    #    p Cookie.from_set_cookie( 'http://owner-url.com', 'session=stuffstuffstuff; Expires=Thu, 01 Jan 1970 00:00:01 GMT' ).first.expired?( future_time )
-    #    #=> true
-    #
-    # @param    [Time]    time    To compare against.
+    # @param    [Time]    time
+    #   To compare against.
     #
     # @return [Boolean]
-    #
     def expired?( time = Time.now )
         expires_at != nil && time > expires_at
     end
 
-    #
     # @example
     #    p Cookie.from_set_cookie( 'http://owner-url.com', 'session=stuffstuffstuff' ).first.simple
     #    #=> {"session"=>"stuffstuffstuff"}
@@ -216,45 +142,30 @@ class Cookie < Arachni::Element::Base
     #   Simple representation of the cookie as a hash -- with the cookie name as
     #   `key` and the cookie value as `value`.
     def simple
-        self.auditable.dup
-    end
-
-    # @return   [String]    Name of the current element, 'cookie' in this case.
-    # @see Arachni::Element::COOKIE
-    def type
-        Arachni::Element::COOKIE
+        self.inputs.dup
     end
 
-    def dup
-        super.tap { |d| d.action = self.action }
-    end
-
-    #
     # @example
     #    p c = Cookie.from_set_cookie( 'http://owner-url.com', 'session=stuffstuffstuff' ).first
     #    #=> ["session=stuffstuffstuff"]
     #
-    #    p c.auditable
+    #    p c.inputs
     #    #=> {"session"=>"stuffstuffstuff"}
     #
-    #    p c.auditable = { 'new-name' => 'new-value' }
+    #    p c.inputs = { 'new-name' => 'new-value' }
     #    #=> {"new-name"=>"new-value"}
     #
     #    p c
     #    #=> new-name=new-value
     #
-    #
-    # @param    [Hash]  inputs   Sets auditable inputs.
-    #
-    def auditable=( inputs )
+    # @param    [Hash]  inputs
+    #   Sets inputs.
+    def inputs=( inputs )
         k = inputs.keys.first.to_s
         v = inputs.values.first.to_s
 
-        raw = @raw.dup
-        raw['name']  = k
-        raw['value'] = v
-
-        @raw = raw.freeze
+        @data[:name]  = k
+        @data[:value] = v
 
         if k.to_s.empty?
             super( {} )
@@ -272,762 +183,326 @@ class Cookie < Arachni::Element::Base
     # @yieldparam (see Capabilities::Mutable#each_mutation)
     #
     # @see Capabilities::Mutable#each_mutation
-    def each_mutation( injection_str, opts = {}, &block )
+    def each_mutation( payload, opts = {}, &block )
         flip = opts.delete( :param_flip )
 
-        super( injection_str, opts ) do |elem|
+        super( payload, opts ) do |elem|
             yield elem
 
-            next if !Arachni::Options.audit_cookies_extensively?
-            elem.each_extensive_mutation( &block )
+            next if !Arachni::Options.audit.cookies_extensively?
+            elem.each_extensive_mutation( elem, &block )
         end
 
         return if !flip
-        elem = self.dup
 
-        # when under HPG mode element auditing is strictly regulated
-        # and when we flip params we essentially create a new element
-        # which won't be on the whitelist
-        elem.override_instance_scope
+        if !valid_input_name_data?( payload )
+            print_debug_level_2 'Payload not supported as input value by' <<
+                                    " #{audit_id}: #{payload.inspect}"
+            return
+        end
 
-        elem.altered = 'Parameter flip'
-        elem.auditable = { injection_str => seed }
+        elem = self.dup
+        elem.affected_input_name = 'Parameter flip'
+        elem.inputs = { payload => seed }
         yield elem if block_given?
     end
 
-    def each_extensive_mutation
+    def each_extensive_mutation( mutation )
         return if orphan?
 
         (auditor.page.links | auditor.page.forms).each do |e|
-            next if e.auditable.empty?
+            next if e.inputs.empty?
 
             c = e.dup
-            c.altered = "mutation for the '#{name}' cookie"
+            c.affected_input_name = "mutation for the '#{name}' cookie"
             c.auditor = auditor
-            c.opts[:cookies] = self.auditable.dup
-            c.auditable = Arachni::Support::KeyFiller.fill( c.auditable.dup )
+            c.audit_options[:submit] ||= {}
+            c.audit_options[:submit][:cookies] = mutation.inputs.dup
+            c.inputs = Arachni::Options.input.fill( c.inputs.dup )
 
             yield c
         end
     end
 
-    #
     # Uses the method name as a key to cookie attributes in {DEFAULT}.
-    #
-    # @example
-    #    c = Cookie.from_set_cookie( 'http://owner-url.com/stuff', 'session=stuffstuffstuff' ).first
-    #
-    #    p c.name
-    #    #=> "session"
-    #
-    #    p c.value
-    #    #=> "stuffstuffstuff"
-    #
-    #    p c.path
-    #    #=> "/stuff"
-    #
-    #
     def method_missing( sym, *args, &block )
-        return @raw[sym.to_s] if respond_to?( sym )
+        return @data[sym] if @data.include? sym
         super( sym, *args, &block )
     end
 
-    #
     # Used by {#method_missing} to determine if it should process the call.
     #
     # @return   [Bool]
     #
-    def respond_to?( sym )
-        (@raw && @raw.include?( sym.to_s )) || super( sym )
+    def respond_to?( *args )
+        (@data && @data.include?( args.first )) || super
     end
 
-    #
-    # @example
-    #    p Cookie.from_set_cookie( 'http://owner-url.com/', 'session=stuffstuffstuff' ).first.to_s
-    #    #=> "session=stuffstuffstuff"
-    #
-    #    p Cookie.new( 'http://owner-url.com/', '% ; freaky name' => 'freaky value;%' ).to_s
-    #    #=> "%25+%3B+freaky+name=freaky+value%3B%25"
-    #
-    #
-    # @return   [String]    To be used in a `Cookie` HTTP request header.
-    #
+    # @return   [String]
+    #   To be used in a `Cookie` HTTP request header.
     def to_s
         "#{encode( name, :name )}=#{encode( value )}"
     end
 
-    #
-    # Parses a Netscape Cookie-jar into an Array of {Cookie}.
-    #
-    # @example Parsing a Netscape HTTP cookiejar file
-    #
-    #   # Given a cookie-jar file with the following contents:
-    #   #
-    #   #   # comment, should be ignored
-    #   #   .domain.com	TRUE	/path/to/somewhere	TRUE	Tue, 02 Oct 2012 19:25:57 GMT	first_name	first_value
-    #   #
-    #   #   # ignored again
-    #   #   another-domain.com	FALSE	/	FALSE	second_name	second_value
-    #   #
-    #   #   # with expiry date as seconds since epoch
-    #   #   .blah-domain	TRUE	/	FALSE	1596981560	NAME	OP5jTLV6VhYHADJAbJ1ZR@L8~081210
-    #
-    #   p Cookie.from_file 'http://owner-url.com', 'cookies.jar'
-    #   #=> [first_name=first_value, second_name=second_value, NAME=OP5jTLV6VhYHADJAbJ1ZR@L8~081210]
-    #
-    #   # And here's the fancier dump:
-    #   # [
-    #   #     [0] #<Arachni::Element::Cookie:0x011636d0
-    #   #         attr_accessor :action = "http://owner-url.com/",
-    #   #         attr_accessor :auditable = {
-    #   #             "first_name" => "first_value"
-    #   #         },
-    #   #         attr_accessor :method = "get",
-    #   #         attr_accessor :url = "http://owner-url.com/",
-    #   #         attr_reader :hash = -473180912834263695,
-    #   #         attr_reader :opts = {},
-    #   #         attr_reader :orig = {
-    #   #             "first_name" => "first_value"
-    #   #         },
-    #   #         attr_reader :raw = {
-    #   #                  "domain" => ".domain.com",
-    #   #                    "path" => "/path/to/somewhere",
-    #   #                  "secure" => true,
-    #   #                 "expires" => 2012-10-02 22:25:57 +0300,
-    #   #                    "name" => "first_name",
-    #   #                   "value" => "first_value",
-    #   #                 "version" => 0,
-    #   #                    "port" => nil,
-    #   #                 "discard" => nil,
-    #   #             "comment_url" => nil,
-    #   #                 "max_age" => nil,
-    #   #                 "comment" => nil,
-    #   #                "httponly" => false
-    #   #         }
-    #   #     >,
-    #   #     [1] #<Arachni::Element::Cookie:0x011527b8
-    #   #         attr_accessor :action = "http://owner-url.com/",
-    #   #         attr_accessor :auditable = {
-    #   #             "second_name" => "second_value"
-    #   #         },
-    #   #         attr_accessor :method = "get",
-    #   #         attr_accessor :url = "http://owner-url.com/",
-    #   #         attr_reader :hash = -2673771862017142861,
-    #   #         attr_reader :opts = {},
-    #   #         attr_reader :orig = {
-    #   #             "second_name" => "second_value"
-    #   #         },
-    #   #         attr_reader :raw = {
-    #   #                  "domain" => "another-domain.com",
-    #   #                    "path" => "/",
-    #   #                  "secure" => false,
-    #   #                 "expires" => nil,
-    #   #                    "name" => "second_name",
-    #   #                   "value" => "second_value",
-    #   #                 "version" => 0,
-    #   #                    "port" => nil,
-    #   #                 "discard" => nil,
-    #   #             "comment_url" => nil,
-    #   #                 "max_age" => nil,
-    #   #                 "comment" => nil,
-    #   #                "httponly" => false
-    #   #         }
-    #   #     >,
-    #   #     [2] #<Arachni::Element::Cookie:0x011189f0
-    #   #         attr_accessor :action = "http://owner-url.com/",
-    #   #         attr_accessor :auditable = {
-    #   #             "NAME" => "OP5jTLV6VhYHADJAbJ1ZR@L8~081210"
-    #   #         },
-    #   #         attr_accessor :method = "get",
-    #   #         attr_accessor :url = "http://owner-url.com/",
-    #   #         attr_reader :hash = 4086929775905476282,
-    #   #         attr_reader :opts = {},
-    #   #         attr_reader :orig = {
-    #   #             "NAME" => "OP5jTLV6VhYHADJAbJ1ZR@L8~081210"
-    #   #         },
-    #   #         attr_reader :raw = {
-    #   #                  "domain" => ".blah-domain",
-    #   #                    "path" => "/",
-    #   #                  "secure" => false,
-    #   #                 "expires" => 2020-08-09 16:59:20 +0300,
-    #   #                    "name" => "NAME",
-    #   #                   "value" => "OP5jTLV6VhYHADJAbJ1ZR@L8~081210",
-    #   #                 "version" => 0,
-    #   #                    "port" => nil,
-    #   #                 "discard" => nil,
-    #   #             "comment_url" => nil,
-    #   #                 "max_age" => nil,
-    #   #                 "comment" => nil,
-    #   #                "httponly" => false
-    #   #         }
-    #   #     >
-    #   # ]
-    #
-    #
-    # @param   [String]    url          request URL
-    # @param   [String]    filepath     Netscape HTTP cookiejar file
-    #
-    # @return   [Array<Cookie>]
-    #
-    # @see http://curl.haxx.se/rfc/cookie_spec.html
-    #
-    def self.from_file( url, filepath )
-        File.open( filepath, 'r' ).map do |line|
-            # skip empty lines
-            next if (line = line.strip).empty? || line[0] == '#'
-
-            c = {}
-            c['domain'], foo, c['path'], c['secure'], c['expires'], c['name'],
-                c['value'] = *line.split( "\t" )
-
-            # expiry date is optional so if we don't have one push everything back
-            begin
-                c['expires'] = expires_to_time( c['expires'] )
-            rescue
-                c['value'] = c['name'].dup
-                c['name'] = c['expires'].dup
-                c['expires'] = nil
-            end
-            c['secure'] = (c['secure'] == 'TRUE') ? true : false
-            new( url, c )
-        end.flatten.compact
+    # @return   [String]
+    #   Converts self to a `Set-Cookie` string.
+    def to_set_cookie
+        set_cookie = "#{self.to_s}; "
+        set_cookie << @data.map do |k, v|
+            next if !v || !self.class.keep_for_set_cookie.include?( k )
+            "#{k.capitalize}=#{v}"
+        end.compact.join( '; ' )
+
+        set_cookie << '; Secure'   if secure?
+        set_cookie << '; HttpOnly' if http_only?
+        set_cookie
     end
 
-    #
-    # Converts a cookie's expiration date to a Ruby `Time` object.
-    #
-    # @example String time format
-    #    p Cookie.expires_to_time "Tue, 02 Oct 2012 19:25:57 GMT"
-    #    #=> 2012-10-02 22:25:57 +0300
-    #
-    # @example Seconds since Epoch
-    #    p Cookie.expires_to_time "1596981560"
-    #    #=> 2020-08-09 16:59:20 +0300
-    #
-    #    p Cookie.expires_to_time 1596981560
-    #    #=> 2020-08-09 16:59:20 +0300
-    #
-    # @param    [String]    expires
-    #
-    # @return   [Time]
-    #
-    def self.expires_to_time( expires )
-        return nil if expires == '0'
-        (expires_to_i = expires.to_i) > 0 ? Time.at( expires_to_i ) : Time.parse( expires )
+    # @see .encode
+    def encode( *args )
+        self.class.encode( *args )
     end
 
-    #
-    # Extracts cookies from an HTTP {Typhoeus::Response response}.
-    #
-    # @example
-    #    body = <<-HTML
-    #        <html>
-    #            <head>
-    #                <meta http-equiv="Set-Cookie" content="cookie=val; httponly">
-    #                <meta http-equiv="Set-Cookie" content="cookie2=val2; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; Domain=.foo.com; HttpOnly; secure">
-    #            </head>
-    #        </html>
-    #    HTML
-    #
-    #    response = Typhoeus::Response.new(
-    #        body:          body,
-    #        effective_url: 'http://stuff.com',
-    #        headers_hash:  {
-    #           'Set-Cookie' => "coo%40ki+e2=blah+val2%40; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; Domain=.foo.com; HttpOnly"
-    #       }
-    #    )
-    #
-    #    p Cookie.from_response response
-    #    # [cookie=val, cookie2=val2, coo@ki+e2=blah+val2@]
-    #
-    #    # Fancy dump:
-    #    # [
-    #    #     [0] #<Arachni::Element::Cookie:0x028e30f8
-    #    #         attr_accessor :action = "http://stuff.com/",
-    #    #         attr_accessor :auditable = {
-    #    #             "cookie" => "val"
-    #    #         },
-    #    #         attr_accessor :method = "get",
-    #    #         attr_accessor :url = "http://stuff.com/",
-    #    #         attr_reader :hash = 2101892390575163651,
-    #    #         attr_reader :opts = {},
-    #    #         attr_reader :orig = {
-    #    #             "cookie" => "val"
-    #    #         },
-    #    #         attr_reader :raw = {
-    #    #                    "name" => "cookie",
-    #    #                   "value" => "val",
-    #    #                 "version" => 0,
-    #    #                    "port" => nil,
-    #    #                 "discard" => nil,
-    #    #             "comment_url" => nil,
-    #    #                 "expires" => nil,
-    #    #                 "max_age" => nil,
-    #    #                 "comment" => nil,
-    #    #                  "secure" => nil,
-    #    #                    "path" => "/",
-    #    #                  "domain" => "stuff.com",
-    #    #                "httponly" => true
-    #    #         }
-    #    #     >,
-    #    #     [1] #<Arachni::Element::Cookie:0x028ec0e0
-    #    #         attr_accessor :action = "http://stuff.com/",
-    #    #         attr_accessor :auditable = {
-    #    #             "cookie2" => "val2"
-    #    #         },
-    #    #         attr_accessor :method = "get",
-    #    #         attr_accessor :url = "http://stuff.com/",
-    #    #         attr_reader :hash = 1525536412599744532,
-    #    #         attr_reader :opts = {},
-    #    #         attr_reader :orig = {
-    #    #             "cookie2" => "val2"
-    #    #         },
-    #    #         attr_reader :raw = {
-    #    #                    "name" => "cookie2",
-    #    #                   "value" => "val2",
-    #    #                 "version" => 0,
-    #    #                    "port" => nil,
-    #    #                 "discard" => nil,
-    #    #             "comment_url" => nil,
-    #    #                 "expires" => 1970-01-01 02:00:01 +0200,
-    #    #                 "max_age" => nil,
-    #    #                 "comment" => nil,
-    #    #                  "secure" => true,
-    #    #                    "path" => "/",
-    #    #                  "domain" => ".foo.com",
-    #    #                "httponly" => true
-    #    #         }
-    #    #     >,
-    #    #     [2] #<Arachni::Element::Cookie:0x028ef3f8
-    #    #         attr_accessor :action = "http://stuff.com/",
-    #    #         attr_accessor :auditable = {
-    #    #             "coo@ki e2" => "blah val2@"
-    #    #         },
-    #    #         attr_accessor :method = "get",
-    #    #         attr_accessor :url = "http://stuff.com/",
-    #    #         attr_reader :hash = 3179884445716720825,
-    #    #         attr_reader :opts = {},
-    #    #         attr_reader :orig = {
-    #    #             "coo@ki e2" => "blah val2@"
-    #    #         },
-    #    #         attr_reader :raw = {
-    #    #                    "name" => "coo@ki e2",
-    #    #                   "value" => "blah val2@",
-    #    #                 "version" => 0,
-    #    #                    "port" => nil,
-    #    #                 "discard" => nil,
-    #    #             "comment_url" => nil,
-    #    #                 "expires" => 1970-01-01 02:00:01 +0200,
-    #    #                 "max_age" => nil,
-    #    #                 "comment" => nil,
-    #    #                  "secure" => nil,
-    #    #                    "path" => "/",
-    #    #                  "domain" => ".foo.com",
-    #    #                "httponly" => true
-    #    #         }
-    #    #     >
-    #    # ]
-    #
-    # @param   [Typhoeus::Response]    response
-    #
-    # @return   [Array<Cookie>]
-    #
-    # @see .from_document
-    # @see .from_headers
-    #
-    def self.from_response( response )
-        ( from_document( response.effective_url, response.body ) |
-         from_headers( response.effective_url, response.headers_hash ) )
+    # @see .decode
+    def decode( str )
+        self.class.decode( str )
     end
 
-    #
-    # Extracts cookies from a document based on `Set-Cookie` `http-equiv` meta tags.
-    #
-    # @example
-    #
-    #    body = <<-HTML
-    #        <html>
-    #            <head>
-    #                <meta http-equiv="Set-Cookie" content="cookie=val; httponly">
-    #                <meta http-equiv="Set-Cookie" content="cookie2=val2; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; Domain=.foo.com; HttpOnly; secure">
-    #            </head>
-    #        </html>
-    #    HTML
-    #
-    #    p Cookie.from_document 'http://owner-url.com', body
-    #    #=> [cookie=val, cookie2=val2]
-    #
-    #    p Cookie.from_document 'http://owner-url.com', Nokogiri::HTML( body )
-    #    #=> [cookie=val, cookie2=val2]
-    #
-    #    # Fancy dump:
-    #    # [
-    #    #     [0] #<Arachni::Element::Cookie:0x02a23030
-    #    #         attr_accessor :action = "http://owner-url.com/",
-    #    #         attr_accessor :auditable = {
-    #    #             "cookie" => "val"
-    #    #         },
-    #    #         attr_accessor :method = "get",
-    #    #         attr_accessor :url = "http://owner-url.com/",
-    #    #         attr_reader :hash = 1135494168462266792,
-    #    #         attr_reader :opts = {},
-    #    #         attr_reader :orig = {
-    #    #             "cookie" => "val"
-    #    #         },
-    #    #         attr_reader :raw = {
-    #    #                    "name" => "cookie",
-    #    #                   "value" => "val",
-    #    #                 "version" => 0,
-    #    #                    "port" => nil,
-    #    #                 "discard" => nil,
-    #    #             "comment_url" => nil,
-    #    #                 "expires" => nil,
-    #    #                 "max_age" => nil,
-    #    #                 "comment" => nil,
-    #    #                  "secure" => nil,
-    #    #                    "path" => "/",
-    #    #                  "domain" => "owner-url.com",
-    #    #                "httponly" => true
-    #    #         }
-    #    #     >,
-    #    #     [1] #<Arachni::Element::Cookie:0x026745b0
-    #    #         attr_accessor :action = "http://owner-url.com/",
-    #    #         attr_accessor :auditable = {
-    #    #             "cookie2" => "val2"
-    #    #         },
-    #    #         attr_accessor :method = "get",
-    #    #         attr_accessor :url = "http://owner-url.com/",
-    #    #         attr_reader :hash = -765632517082248204,
-    #    #         attr_reader :opts = {},
-    #    #         attr_reader :orig = {
-    #    #             "cookie2" => "val2"
-    #    #         },
-    #    #         attr_reader :raw = {
-    #    #                    "name" => "cookie2",
-    #    #                   "value" => "val2",
-    #    #                 "version" => 0,
-    #    #                    "port" => nil,
-    #    #                 "discard" => nil,
-    #    #             "comment_url" => nil,
-    #    #                 "expires" => 1970-01-01 02:00:01 +0200,
-    #    #                 "max_age" => nil,
-    #    #                 "comment" => nil,
-    #    #                  "secure" => true,
-    #    #                    "path" => "/",
-    #    #                  "domain" => ".foo.com",
-    #    #                "httponly" => true
-    #    #         }
-    #    #     >
-    #    # ]
-    #
-    # @param    [String]    url     Owner URL.
-    # @param    [String, Nokogiri::HTML::Document]    document
-    #
-    # @return   [Array<Cookie>]
-    #
-    # @see .parse_set_cookie
-    #
-    def self.from_document( url, document )
-        # optimizations in case there are no cookies in the doc,
-        # avoid parsing unless absolutely necessary!
-        if !document.is_a?( Nokogiri::HTML::Document )
-            # get get the head in order to check if it has an http-equiv for set-cookie
-            head = document.to_s.match( /<head(.*)<\/head>/imx )
+    def to_rpc_data
+        h = super
+        if expires_at
+            h.merge(
+               'initialization_options' => h['initialization_options'].merge( expires: expires_at.to_s ),
+               'data'                   => h['data'].merge( expires: expires_at.to_s )
+            )
+        else
+            h
+        end
+    end
 
-            # if it does feed the head to the parser in order to extract the cookies
-            return [] if !head || !head.to_s.downcase.substring?( 'set-cookie' )
+    class <<self
+
+        def from_rpc_data( data )
+            if data['initialization_options']['expires'] &&
+                !data['initialization_options']['expires'].is_a?( Time )
+
+                data['initialization_options']['expires'] =
+                    Time.parse( data['initialization_options']['expires'] ) rescue nil
+            end
 
-            document = Nokogiri::HTML( head.to_s )
+            super data
         end
 
-        Arachni::Utilities.exception_jail {
-            document.search( "//meta[@http-equiv]" ).map do |elem|
-                next if elem['http-equiv'].downcase != 'set-cookie'
-                parse_set_cookie( url, elem['content'] )
+        # Parses a Netscape Cookie-jar into an Array of {Cookie}.
+        #
+        # @param   [String]    url
+        #   {HTTP::Request} URL.
+        # @param   [String]    filepath
+        #   Netscape HTTP cookiejar file.
+        #
+        # @return   [Array<Cookie>]
+        #
+        # @see http://curl.haxx.se/rfc/cookie_spec.html
+        def from_file( url, filepath )
+            File.open( filepath, 'r' ).map do |line|
+                # skip empty lines
+                next if (line = line.strip).empty? || line[0] == '#'
+
+                c = {}
+                c['domain'], foo, c['path'], c['secure'], c['expires'], c['name'],
+                    c['value'] = *line.split( "\t" )
+
+                # expiry date is optional so if we don't have one push everything back
+                begin
+                    c['expires'] = expires_to_time( c['expires'] )
+                rescue
+                    c['value'] = c['name'].dup
+                    c['name'] = c['expires'].dup
+                    c['expires'] = nil
+                end
+                c['secure'] = (c['secure'] == 'TRUE') ? true : false
+                new( { url: url }.merge( c.symbolize_keys ) )
             end.flatten.compact
-        } rescue []
-    end
+        end
 
-    #
-    # Extracts cookies from the `Set-Cookie` HTTP response header field.
-    #
-    # @example
-    #    p Cookie.from_headers 'http://owner-url.com', { 'Set-Cookie' => "coo%40ki+e2=blah+val2%40" }
-    #    #=> [coo@ki+e2=blah+val2@]
-    #
-    #    # Fancy dump:
-    #    # [
-    #    #     [0] #<Arachni::Element::Cookie:0x01e17250
-    #    #         attr_accessor :action = "http://owner-url.com/",
-    #    #         attr_accessor :auditable = {
-    #    #             "coo@ki e2" => "blah val2@"
-    #    #         },
-    #    #         attr_accessor :method = "get",
-    #    #         attr_accessor :url = "http://owner-url.com/",
-    #    #         attr_reader :hash = -1249755840178478661,
-    #    #         attr_reader :opts = {},
-    #    #         attr_reader :orig = {
-    #    #             "coo@ki e2" => "blah val2@"
-    #    #         },
-    #    #         attr_reader :raw = {
-    #    #                    "name" => "coo@ki e2",
-    #    #                   "value" => "blah val2@",
-    #    #                 "version" => 0,
-    #    #                    "port" => nil,
-    #    #                 "discard" => nil,
-    #    #             "comment_url" => nil,
-    #    #                 "expires" => nil,
-    #    #                 "max_age" => nil,
-    #    #                 "comment" => nil,
-    #    #                  "secure" => nil,
-    #    #                    "path" => "/",
-    #    #                  "domain" => "owner-url.com",
-    #    #                "httponly" => false
-    #    #         }
-    #    #     >
-    #    # ]
-    #
-    # @param    [String]    url     request URL
-    # @param    [Hash]      headers
-    #
-    # @return   [Array<Cookie>]
-    #
-    # @see .forms_set_cookie
-    #
-    def self.from_headers( url, headers )
-        set_strings = []
-        headers.each { |k, v| set_strings = [v].flatten if k.downcase == 'set-cookie' }
-
-        return set_strings if set_strings.empty?
-        exception_jail {
-            set_strings.map { |c| parse_set_cookie( url, c ) }.flatten
-        } rescue []
-    end
+        # Converts a cookie's expiration date to a Ruby `Time` object.
+        #
+        # @example String time format
+        #    p Cookie.expires_to_time "Tue, 02 Oct 2012 19:25:57 GMT"
+        #    #=> 2012-10-02 22:25:57 +0300
+        #
+        # @example Seconds since Epoch
+        #    p Cookie.expires_to_time "1596981560"
+        #    #=> 2020-08-09 16:59:20 +0300
+        #
+        #    p Cookie.expires_to_time 1596981560
+        #    #=> 2020-08-09 16:59:20 +0300
+        #
+        # @param    [String]    expires
+        #
+        # @return   [Time]
+        def expires_to_time( expires )
+            return nil if expires == '0'
+            (expires_to_i = expires.to_i) > 0 ? Time.at( expires_to_i ) : Time.parse( expires )
+        end
 
-    #
-    # Parses the `Set-Cookie` header value into cookie elements.
-    #
-    # @example
-    #    p Cookie.from_set_cookie 'http://owner-url.com', "coo%40ki+e2=blah+val2%40"
-    #    #=> [coo@ki+e2=blah+val2@]
-    #
-    #    # Fancy dump:
-    #    # [
-    #    #     [0] #<Arachni::Element::Cookie:0x01e17250
-    #    #         attr_accessor :action = "http://owner-url.com/",
-    #    #         attr_accessor :auditable = {
-    #    #             "coo@ki e2" => "blah val2@"
-    #    #         },
-    #    #         attr_accessor :method = "get",
-    #    #         attr_accessor :url = "http://owner-url.com/",
-    #    #         attr_reader :hash = -1249755840178478661,
-    #    #         attr_reader :opts = {},
-    #    #         attr_reader :orig = {
-    #    #             "coo@ki e2" => "blah val2@"
-    #    #         },
-    #    #         attr_reader :raw = {
-    #    #                    "name" => "coo@ki e2",
-    #    #                   "value" => "blah val2@",
-    #    #                 "version" => 0,
-    #    #                    "port" => nil,
-    #    #                 "discard" => nil,
-    #    #             "comment_url" => nil,
-    #    #                 "expires" => nil,
-    #    #                 "max_age" => nil,
-    #    #                 "comment" => nil,
-    #    #                  "secure" => nil,
-    #    #                    "path" => "/",
-    #    #                  "domain" => "owner-url.com",
-    #    #                "httponly" => false
-    #    #         }
-    #    #     >
-    #    # ]
-    #
-    #
-    # @param    [String]    url     Request URL.
-    # @param    [Hash]      str     `Set-Cookie` string
-    #
-    # @return   [Array<Cookie>]
-    #
-    def self.from_set_cookie( url, str )
-        WEBrick::Cookie.parse_set_cookies( str ).flatten.uniq.map do |cookie|
-            cookie_hash = {}
-            cookie.instance_variables.each do |var|
-                cookie_hash[var.to_s.gsub( /@/, '' )] = cookie.instance_variable_get( var )
+        # Extracts cookies from an HTTP {Arachni::HTTP::Response response}.
+        #
+        # @param   [Arachni::HTTP::Response]    response
+        #
+        # @return   [Array<Cookie>]
+        #
+        # @see .from_document
+        # @see .from_headers
+        def from_response( response )
+            ( from_document( response.url, response.body ) |
+                from_headers( response.url, response.headers ) )
+        end
+
+        # Extracts cookies from a document based on `Set-Cookie` `http-equiv`
+        # meta tags.
+        #
+        # @param    [String]    url
+        #   Owner URL.
+        # @param    [String, Nokogiri::HTML::Document]    document
+        #
+        # @return   [Array<Cookie>]
+        #
+        # @see .parse_set_cookie
+        def from_document( url, document )
+            # optimizations in case there are no cookies in the doc,
+            # avoid parsing unless absolutely necessary!
+            if !document.is_a?( Nokogiri::HTML::Document )
+                # get get the head in order to check if it has an http-equiv for set-cookie
+                head = document.to_s.match( /<head(.*)<\/head>/imx )
+
+                # if it does feed the head to the parser in order to extract the cookies
+                return [] if !head || !head.to_s.downcase.include?( 'set-cookie' )
+
+                document = Nokogiri::HTML( head.to_s )
             end
-            cookie_hash['expires'] = cookie.expires
 
-            cookie_hash['path'] ||= '/'
-            cookie_hash['name']  = decode( cookie.name )
-            cookie_hash['value'] = decode( cookie.value )
+            Arachni::Utilities.exception_jail {
+                document.search( "//meta[@http-equiv]" ).map do |elem|
+                    next if elem['http-equiv'].downcase != 'set-cookie'
+                    from_set_cookie( url, elem['content'] )
+                end.flatten.compact
+            } rescue []
+        end
 
-            new( url.to_s, cookie_hash )
-        end.flatten.compact
-    end
-    def self.parse_set_cookie( *args )
-        from_set_cookie( *args )
-    end
+        # Extracts cookies from the `Set-Cookie` HTTP response header field.
+        #
+        # @param    [String]    url
+        #   {HTTP::Request} URL.
+        # @param    [Hash]      headers
+        #
+        # @return   [Array<Cookie>]
+        #
+        # @see .forms_set_cookie
+        def from_headers( url, headers )
+            headers = Arachni::HTTP::Headers.new( headers )
+            return [] if headers.set_cookie.empty?
+
+            exception_jail {
+                headers.set_cookie.map { |c| from_set_cookie( url, c ) }.flatten
+            } rescue []
+        end
 
-    #
-    # Parses a string formatted for the `Cookie` HTTP request header field
-    # into cookie elements.
-    #
-    # @example
-    #    p Cookie.from_string 'http://owner-url.com', "coo%40ki+e2=blah+val2%40;name=value;name2=value2"
-    #    #=> [coo@ki+e2=blah+val2@, name=value, name2=value2]
-    #
-    #     # Fancy dump:
-    #     #     [
-    #     #         [0] #<Arachni::Element::Cookie:0x01c31558
-    #     #             attr_accessor :action = "http://owner-url.com/",
-    #     #             attr_accessor :auditable = {
-    #     #                 "coo@ki e2" => "blah val2@"
-    #     #             },
-    #     #             attr_accessor :method = "get",
-    #     #             attr_accessor :url = "http://owner-url.com/",
-    #     #             attr_reader :hash = 3934200888666098208,
-    #     #             attr_reader :opts = {},
-    #     #             attr_reader :orig = {
-    #     #                 "coo@ki e2" => "blah val2@"
-    #     #             },
-    #     #             attr_reader :raw = {
-    #     #                 "coo@ki e2" => "blah val2@",
-    #     #                     "name" => "coo@ki e2",
-    #     #                     "value" => "blah val2@",
-    #     #                     "version" => 0,
-    #     #                     "port" => nil,
-    #     #                     "discard" => nil,
-    #     #                 "comment_url" => nil,
-    #     #                     "expires" => nil,
-    #     #                     "max_age" => nil,
-    #     #                     "comment" => nil,
-    #     #                     "secure" => nil,
-    #     #                     "path" => "/",
-    #     #                     "domain" => "owner-url.com",
-    #     #                 "httponly" => false
-    #     #             }
-    #     #         >,
-    #     #         [1] #<Arachni::Element::Cookie:0x01b17fc8
-    #     #             attr_accessor :action = "http://owner-url.com/",
-    #     #             attr_accessor :auditable = {
-    #     #                 "name" => "value"
-    #     #             },
-    #     #             attr_accessor :method = "get",
-    #     #             attr_accessor :url = "http://owner-url.com/",
-    #     #             attr_reader :hash = -2610555034726366868,
-    #     #             attr_reader :opts = {},
-    #     #             attr_reader :orig = {
-    #     #                 "name" => "value"
-    #     #             },
-    #     #             attr_reader :raw = {
-    #     #                     "name" => "name",
-    #     #                     "value" => "value",
-    #     #                     "version" => 0,
-    #     #                     "port" => nil,
-    #     #                     "discard" => nil,
-    #     #                 "comment_url" => nil,
-    #     #                     "expires" => nil,
-    #     #                     "max_age" => nil,
-    #     #                     "comment" => nil,
-    #     #                     "secure" => nil,
-    #     #                     "path" => "/",
-    #     #                     "domain" => "owner-url.com",
-    #     #                 "httponly" => false
-    #     #             }
-    #     #         >,
-    #     #         [2] #<Arachni::Element::Cookie:0x01767b08
-    #     #             attr_accessor :action = "http://owner-url.com/",
-    #     #             attr_accessor :auditable = {
-    #     #                 "name2" => "value2"
-    #     #             },
-    #     #             attr_accessor :method = "get",
-    #     #             attr_accessor :url = "http://owner-url.com/",
-    #     #             attr_reader :hash = 3819162339364446155,
-    #     #             attr_reader :opts = {},
-    #     #             attr_reader :orig = {
-    #     #                 "name2" => "value2"
-    #     #             },
-    #     #             attr_reader :raw = {
-    #     #                     "name2" => "value2",
-    #     #                     "name" => "name2",
-    #     #                     "value" => "value2",
-    #     #                     "version" => 0,
-    #     #                     "port" => nil,
-    #     #                     "discard" => nil,
-    #     #                 "comment_url" => nil,
-    #     #                     "expires" => nil,
-    #     #                     "max_age" => nil,
-    #     #                     "comment" => nil,
-    #     #                     "secure" => nil,
-    #     #                     "path" => "/",
-    #     #                     "domain" => "owner-url.com",
-    #     #                 "httponly" => false
-    #     #             }
-    #     #         >
-    #     #     ]
-    #
-    #
-    # @param    [String]    url     Request URL.
-    # @param    [Hash]      string  `Set-Cookie` string.
-    #
-    # @return   [Array<Cookie>]
-    #
-    def self.from_string( url, string )
-        string.split( ';' ).map do |cookie_pair|
-            k, v = *cookie_pair.split( '=', 2 )
-            new( url, decode( k.strip ) => decode( v.strip ) )
-        end.flatten.compact
-    end
+        # Parses the `Set-Cookie` header value into cookie elements.
+        #
+        # @param    [String]    url
+        #   {HTTP::Request} URL.
+        # @param    [Hash]      str
+        #   `Set-Cookie` string
+        #
+        # @return   [Array<Cookie>]
+        def from_set_cookie( url, str )
+            WEBrick::Cookie.parse_set_cookies( str ).flatten.uniq.map do |cookie|
+                cookie_hash = {}
+                cookie.instance_variables.each do |var|
+                    cookie_hash[var.to_s.gsub( /@/, '' )] = cookie.instance_variable_get( var )
+                end
+                cookie_hash['expires'] = cookie.expires
+
+                cookie_hash['path'] ||= '/'
+                cookie_hash['name']  = decode( cookie.name )
+                cookie_hash['value'] = decode( cookie.value )
+
+                new( { url: url }.merge( cookie_hash.symbolize_keys ) )
+            end.flatten.compact
+        end
+        alias :parse_set_cookie :from_set_cookie
+
+        # Parses a string formatted for the `Cookie` HTTP request header field
+        # into cookie elements.
+        #
+        # @param    [String]    url
+        #   {HTTP::Request} URL.
+        # @param    [Hash]      string
+        #   `Cookie` string.
+        #
+        # @return   [Array<Cookie>]
+        def from_string( url, string )
+            return [] if string.empty?
+            string.split( ';' ).map do |cookie_pair|
+                k, v = *cookie_pair.split( '=', 2 )
+                new( url: url, inputs: { decode( k.strip ) => decode( v.strip ) } )
+            end.flatten.compact
+        end
 
-    #
-    # Encodes a {String}'s reserved characters in order to prepare it for
-    # the `Cookie` header field.
-    #
-    # @example
-    #    p Cookie.encode "+;%=\0 "
-    #    #=> "%2B%3B%25%3D%00+"
-    #
-    # @param    [String]    str
-    #
-    # @return   [String]
-    #
-    def self.encode( str, type = :value )
-        reserved = "+;%\0"
-        reserved << '=' if type == :name
+        # Encodes a {String}'s reserved characters in order to prepare it for
+        # the `Cookie` header field.
+        #
+        # @example
+        #    p Cookie.encode "+;%=\0 "
+        #    #=> "%2B%3B%25%3D%00+"
+        #
+        # @param    [String]    str
+        #
+        # @return   [String]
+        def encode( str, type = :value )
+            reserved = "+;%\0"
+            reserved << '=' if type == :name
+
+            URI.encode( str, reserved ).recode.gsub( ' ', '+' )
+        end
 
-        URI.encode( str, reserved ).recode.gsub( ' ', '+' )
-    end
-    # @see .encode
-    def encode( *args )
-        self.class.encode( *args )
-    end
+        # Decodes a {String} encoded for the `Cookie` header field.
+        #
+        # @example
+        #    p Cookie.decode "%2B%3B%25%3D%00+"
+        #    #=> "+;%=\x00 "
+        #
+        # @param    [String]    str
+        #
+        # @return   [String]
+        def decode( str )
+            URI.decode( str.to_s.recode.gsub( '+', ' ' ) )
+        end
+
+        def keep_for_set_cookie
+            return @keep if @keep
+
+            @keep = Set.new( DEFAULT.keys )
+            @keep.delete( :name )
+            @keep.delete( :value )
+            @keep.delete( :url )
+            @keep.delete( :secure )
+            @keep.delete( :httponly )
+            @keep.delete( :version )
+            @keep
+        end
 
-    #
-    # Decodes a {String} encoded for the `Cookie` header field.
-    #
-    # @example
-    #    p Cookie.decode "%2B%3B%25%3D%00+"
-    #    #=> "+;%=\x00 "
-    #
-    # @param    [String]    str
-    #
-    # @return   [String]
-    #
-    def self.decode( str )
-        URI.decode( str.to_s.recode.gsub( '+', ' ' ) )
-    end
-    # @see .decode
-    def decode( str )
-        self.class.decode( str )
     end
 
     private
+
     def http_request( opts = {}, &block )
-        opts[:cookies] = opts[:params].dup
-        opts[:params] = {}
+        opts[:cookies] = opts.delete( :parameters )
 
-        self.method.downcase.to_s != 'get' ?
-            http.post( self.action, opts, &block ) : http.get( self.action, opts, &block )
+        self.method == :get ?
+            http.get( self.action, opts, &block ) :
+            http.post( self.action, opts, &block )
     end
 
 end