kinetex 1.3.0 → 1.5.0

package/dist/cjs/cookie-parser.js

@@ -1513,7 +1513,12 @@ export function getPublicSuffix(hostname) {
  * For IP addresses, returns the IP itself.
  */
 export function getRegistrableDomain(hostname) {
-    const h = hostname.toLowerCase();
+    // The trailing dot is stripped here for the same reason it is in
+    // getPublicSuffix: without it the two disagreed about the same host.
+    // `getPublicSuffix("1.2.3.4.")` correctly returned "4", but this function
+    // split the *unstripped* string and handed back "4." — a fragment that is
+    // not a domain at all, and one a caller could then use as a cookie domain.
+    const h = hostname.toLowerCase().replace(/\.$/, "");
     if (isIPAddress(h))
         return h;
     const suffix = getPublicSuffix(h);
@@ -1562,10 +1567,21 @@ function decodePunycode(input) {
         const initialN = 0x80;
         const delim = input.lastIndexOf("-");
         const output = [];
+        // RFC 3492 §6.2: the basic part is everything before the *last* delimiter,
+        // so it may contain any basic code point — "-" included. Testing it for
+        // alphanumerics only rejected legal input: "xn--abc-def-" and "xn--a--"
+        // both carry a hyphen inside their basic part, and were returned
+        // undecoded. That left the A-label and its U-label looking like two
+        // different cookie domains, so one host could be registered twice.
+        //
+        // The decoder only ever inserts code points >= initialN (0x80), so the
+        // result can never contain a "." and cannot re-split the domain. Control
+        // characters and non-ASCII are still refused, since neither is a basic
+        // code point and both would be unsafe in a canonicalized cookie domain.
         const basic = delim >= 0 ? input.slice(0, delim) : "";
         for (let j = 0; j < basic.length; j++) {
             const cp = basic.charCodeAt(j);
-            if (cp > 0x7a || (cp > 0x5a && cp < 0x61) || (cp > 0x39 && cp < 0x41) || cp < 0x30)
+            if (cp >= 0x80 || cp < 0x20 || cp === 0x7f)
                 return input;
             output.push(cp);
         }
@@ -1642,6 +1658,22 @@ let _domainToUnicode;
  * @returns Decoded label (e.g., "中国") or original if not punycode
  */
 export function decodeIDNLabel(label) {
+    // A dotted input is a domain, not a single label. Split it and decode each
+    // label, so a full domain answers the same however many labels it has and
+    // whichever decoder ends up handling it.
+    //
+    // This has to happen before the `xn--` test below. Previously a dotted input
+    // that did not *begin* with `xn--` — "sub.xn--bcdf-zna1d.co.uk" — returned
+    // untouched, and one that did was handed whole to the single-label decoder,
+    // which failed on the dot. Whether the lazily-imported `node:url` helper had
+    // resolved decided which of those happened, so the same input could decode or
+    // not depending on module load timing.
+    if (label.includes(".")) {
+        return label
+            .split(".")
+            .map((part) => decodeIDNLabel(part))
+            .join(".");
+    }
     if (!label.toLowerCase().startsWith("xn--")) {
         return label;
     }
@@ -1696,6 +1728,43 @@ export function canonicalizeDomainFull(domain) {
 // ============================================================================
 const IPV4_RE = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/;
 const IPV6_RE = /^[\da-f:]+$/i;
+/**
+ * Structural IPv6 check.
+ *
+ * The previous test was `/^[\da-f:]+$/` plus "contains a colon", which is both
+ * too loose and too strict: it accepted `abc:123` and `cafe:babe` (a hostname
+ * happens to be spelled entirely in hex characters) and rejected the
+ * IPv4-mapped forms `::ffff:1.2.3.4` and `::1.2.3.4`, which are real
+ * addresses. `getRegistrableDomain("::ffff:1.2.3.4")` therefore returned the
+ * fragment "3.4". At most one `::` is allowed, a compressed form stands for
+ * at least one omitted group, and an unadorned form must have all eight.
+ */
+function isIPv6Literal(h) {
+    let s = h;
+    // An embedded dotted quad occupies the last two hextets.
+    const lastColon = s.lastIndexOf(":");
+    if (lastColon >= 0 && s.slice(lastColon + 1).includes(".")) {
+        const v4 = s.slice(lastColon + 1);
+        if (!IPV4_RE.test(v4))
+            return false;
+        const o = v4.split(".").map(Number);
+        if (!o.every((p) => p >= 0 && p <= 255))
+            return false;
+        s =
+            s.slice(0, lastColon + 1) +
+                (((o[0] << 8) | o[1]).toString(16) + ":" + ((o[2] << 8) | o[3]).toString(16));
+    }
+    if (!IPV6_RE.test(s))
+        return false;
+    if (s.split("::").length > 2)
+        return false; // at most one elision
+    const groupCount = (part) => (part ?? "").split(":").filter(Boolean).length;
+    if (s.includes("::")) {
+        const [head, tail] = s.split("::");
+        return groupCount(head) + groupCount(tail) <= 7;
+    }
+    return groupCount(s) === 8;
+}
 /**
  * Check whether a host string is an IPv4 or IPv6 address.
  *
@@ -1708,7 +1777,7 @@ export function isIPAddress(host) {
         const parts = h.split(".").map(Number);
         return parts.every((p) => p >= 0 && p <= 255);
     }
-    return IPV6_RE.test(h) && h.includes(":");
+    return isIPv6Literal(h);
 }
 // ============================================================================
 // 6. RFC 6265 §5.1.3 — DOMAIN MATCHING
@@ -1722,7 +1791,13 @@ export function isIPAddress(host) {
  */
 export function domainMatch(requestHost, cookieDomain) {
     const rh = requestHost.toLowerCase();
-    const cd = cookieDomain.toLowerCase();
+    // RFC 6265 §5.2.3: a leading %x2E (".") in the Domain attribute is ignored.
+    // The parser already strips it, so this mattered only for a caller using
+    // this exported helper directly — and this function's own JSDoc documents
+    // `cookieDomain` as e.g. ".example.com", which it answered `false` for:
+    // neither the exact host nor any subdomain of it ever matched. A cookie set
+    // with the common `Domain=.example.com` spelling was simply not sent.
+    const cd = cookieDomain.toLowerCase().replace(/^\./, "");
     if (rh === cd)
         return true;
     // IP addresses: exact match only
@@ -1873,14 +1948,23 @@ export function parseSetCookieHeader(header) {
     if (eqIdx === -1) {
         // No equals sign at all — treat as value-only (empty name)
         name = "";
-        value = nameValueStr.trim();
+        value = nameValueStr;
     }
     else {
         name = nameValueStr.slice(0, eqIdx).trim();
-        value = nameValueStr.slice(eqIdx + 1).trim();
+        value = nameValueStr.slice(eqIdx + 1);
     }
     if (!isValidCookieName(name))
         return null;
+    // Validate the raw value, BEFORE trimming. `trim()` runs first, so a control
+    // character at either end was stripped along with the surrounding space and
+    // the check could never see it: `a=\r\nX-Injected: 1` came back as the
+    // cookie `a` with the value "X-Injected: 1" instead of being rejected. The
+    // interior case was already refused, so the rejection applied only from the
+    // second character onwards.
+    if (!isValidCookieValue(value))
+        return null;
+    value = value.trim();
     // Strip surrounding double quotes from value (RFC 6265 §5.2 step 3)
     if (value.length >= 2 && value[0] === '"' && value[value.length - 1] === '"') {
         value = value.slice(1, -1);
@@ -2063,6 +2147,31 @@ export function formatSetCookieHeader(cookie) {
  * @param raw - Raw Set-Cookie header string (possibly containing multiple cookies)
  * @returns Array of individual Set-Cookie strings
  */
+/**
+ * Decide whether a comma at `from` separates two cookies or is part of the
+ * value currently being read.
+ *
+ * Looks ahead to the next `,` or `;` — the rest of the current value or
+ * attribute — and reports whether that segment opens a `name=` pair. A
+ * trailing comma with nothing after it also separates, so the empty tail is
+ * dropped rather than kept as a value.
+ */
+function startsNewCookie(raw, from) {
+    let j = from;
+    while (j < raw.length && (raw[j] === " " || raw[j] === "\t"))
+        j++;
+    // Nothing but whitespace after the comma: a trailing separator.
+    if (j >= raw.length)
+        return true;
+    for (; j < raw.length; j++) {
+        const c = raw[j];
+        if (c === ";" || c === ",")
+            return false;
+        if (c === "=")
+            return true;
+    }
+    return false;
+}
 export function splitSetCookieHeaders(raw) {
     const cookies = [];
     let buffer = "";
@@ -2114,6 +2223,22 @@ export function splitSetCookieHeaders(raw) {
             continue;
         }
         if (char === "," && !inQuotedValue && (afterSemicolon || valueComplete || nameComplete)) {
+            // A comma only separates cookies when what follows looks like a new
+            // `name=value` pair. It otherwise belongs to the value being read —
+            // above all `Expires=Thu, 01 Jan 2099 00:00:00 GMT`, the RFC 6265 §5.2
+            // date format, which is the reason this function exists at all.
+            //
+            // The test used to be "have we seen a value or an attribute yet", and
+            // that is true the instant the first `=` is read, so it committed on
+            // EVERY comma: a single cookie carrying an Expires was truncated to
+            // `a=1; Expires=Thu`, silently losing its expiry, and a collapsed
+            // two-cookie header was shredded into fragments such as
+            // `01 Jan 2099 00:00:00 GMT; Path=/; HttpOnly`.
+            if (!startsNewCookie(raw, i + 1)) {
+                buffer += char;
+                i++;
+                continue;
+            }
             commitCookie();
             while (i + 1 < raw.length && /\s/.test(raw[i + 1])) {
                 i++;

package/dist/cjs/cookie-store.js

@@ -79,6 +79,29 @@ function enforcePrefixRules(cookie, requestUrl) {
  * @param context  - The request's SameSite context
  * @returns true if the cookie may be sent
  */
+/**
+ * Canonicalise a `SameSite` read from outside the library.
+ *
+ * `SameSite` is a closed union, so anything arriving from JSON is untrusted
+ * by construction. An unrecognised value (including a missing one) becomes
+ * `"Unset"`, which `sameSiteAllows` treats permissively but still refuses on
+ * an explicit cross-site request.
+ */
+function normalizeSameSite(value) {
+    if (typeof value !== "string")
+        return "Unset";
+    switch (value.trim().toLowerCase()) {
+        case "strict":
+            return "Strict";
+        case "lax":
+            return "Lax";
+        case "none":
+            return "None";
+        case "unset":
+        default:
+            return "Unset";
+    }
+}
 function sameSiteAllows(sameSite, context) {
     switch (sameSite) {
         case "Strict":
@@ -324,6 +347,16 @@ export class CookieJar {
                     if (cookie.name.startsWith("__Host-") &&
                         !(cookie.secure && isSecure && cookie.path === "/" && cookie.hostOnly))
                         continue;
+                    // The same argument applies to RFC 6265 §5.3's "the cookie domain must
+                    // not be a public suffix", which setCookie() enforces but the storage
+                    // map does not: fromJSON()/loadCookieJar() write straight into the map
+                    // and skip setCookie() entirely. A persisted cookie with
+                    // `domain: "com"` — which setCookie refuses — was therefore sent to
+                    // every .com host, so anyone able to write the serialized jar (an XSS
+                    // bug plus localStorage) got a cross-site cookie-tossing primitive.
+                    // A cookie whose domain is a public suffix is never emitted.
+                    if (isPublicSuffix(cookie.domain))
+                        continue;
                     result.push(cookie);
                 }
             }
@@ -336,13 +369,23 @@ export class CookieJar {
             return a.createdAt - b.createdAt;
         });
         // §5.4 step 3: update last-access time
+        //
+        // The timestamp is stamped on the STORED cookie, because that is the value
+        // LRU eviction orders by, and the caller receives copies. It used to return
+        // the stored objects themselves, so
+        // `jar.getCookies(opts)[0].value = "x"` rewrote the jar's contents — while
+        // getAll() and getForDomain() both return copies, leaving the two halves of
+        // the same API disagreeing about whether the result was yours to modify.
         const ts = Date.now();
-        for (const c of result) {
-            // Note: getCookies returns direct references to stored cookies, not copies.
-            // Modifying lastAccessed here directly updates the stored cookie.
+        // The snapshot is taken before the stamp, so a caller sees the cookie as it
+        // was stored at the moment of the call while the jar records the access.
+        // Copying first and stamping after also means a mutation of the returned
+        // object cannot write a lastAccessed back into the store.
+        return result.map((c) => {
+            const snapshot = { ...c };
             c.lastAccessed = ts;
-        }
-        return result;
+            return snapshot;
+        });
     }
     // --------------------------------------------------------------------------
     // 7.3  getCookieHeader
@@ -374,15 +417,38 @@ export class CookieJar {
     getCookiesForDomain(domain) {
         const d = canonicalizeDomainFull(domain);
         const result = [];
+        const now = Date.now();
         for (const [stored, pm] of this.dm) {
-            // Match domain or its subdomains
-            if (stored === d || stored.endsWith("." + d)) {
+            // A domain is in scope if it is `d` itself, a subdomain of it, or an
+            // ancestor of it. The ancestor case was missing, so the result
+            // disagreed with getCookieHeader() for every subdomain query:
+            // getCookiesForDomain("sub.example.com") listed only the host-only
+            // cookie while the request actually sent "hostonly=1; domainwide=1",
+            // and "deep.sub.example.com" returned nothing at all. A parent-domain
+            // cookie applies to every host beneath it (RFC 6265 §5.3 step 5), and
+            // the host-only check below already keeps an ancestor's host-only
+            // cookie out of the result.
+            if (stored === d || stored.endsWith("." + d) || d.endsWith("." + stored)) {
                 for (const [, nm] of pm) {
                     for (const [, cookie] of nm) {
                         // Skip expired cookies
-                        if (cookie.expires !== Infinity && cookie.expires < Date.now())
+                        if (cookie.expires !== Infinity && cookie.expires < now)
                             continue;
-                        result.push(cookie);
+                        // A host-only cookie is bound to its own host and is never sent to
+                        // a sibling or parent domain. The method documents itself as
+                        // returning "cookies that would be sent to this domain", and it was
+                        // returning them anyway: asking for "example.com" listed the
+                        // host-only cookie belonging to "sub.example.com", which never
+                        // reaches example.com. Only exact-domain host-only cookies apply.
+                        if (cookie.hostOnly && cookie.domain !== d)
+                            continue;
+                        // Same public-suffix rule as getCookies().
+                        if (isPublicSuffix(cookie.domain))
+                            continue;
+                        // A copy, like every other accessor. Returning the stored object
+                        // let `jar.getCookiesForDomain(d)[0].value = "x"` rewrite the jar,
+                        // while the method sitting directly above it returned copies.
+                        result.push({ ...cookie });
                     }
                 }
             }
@@ -593,7 +659,16 @@ export class CookieJar {
                 maxAge: item.maxAge,
                 secure: item.secure,
                 httpOnly: item.httpOnly,
-                sameSite: item.sameSite,
+                // Normalized, because this is the one public ingestion path that takes
+                // externally authored JSON verbatim. `sameSiteAllows` switches on the
+                // canonical `"Strict" | "Lax" | "Unset" | "None"` and returns
+                // `undefined` for anything else, and `getCookies` filters on that
+                // result — so a persisted `"lax"`, or a store that simply omitted the
+                // field, produced a jar whose `count` was 1 and whose cookie was never
+                // sent to anything, with no error anywhere. `Unset` is the documented
+                // "cannot tell" bucket: everything except an explicit cross-site
+                // non-navigation request.
+                sameSite: normalizeSameSite(item.sameSite),
                 createdAt: item.createdAt,
                 lastAccessed: item.lastAccessed,
                 hostOnly: item.hostOnly,
@@ -654,31 +729,53 @@ export class CookieJar {
      */
     putCookie(cookie) {
         const { domain, path, name } = cookie;
-        if (!this.dm.has(domain))
-            this.dm.set(domain, new Map());
-        const pm = this.dm.get(domain);
-        if (!pm.has(path))
-            pm.set(path, new Map());
-        const nm = pm.get(path);
-        if (nm.has(name)) {
-            // Update: preserve original createdAt (RFC 6265 §5.3 step 11)
-            const old = nm.get(name);
-            nm.set(name, { ...cookie, createdAt: old.createdAt });
-            // total unchanged — same slot
+        // Update in place: same domain/path/name replaces the value and keeps the
+        // original createdAt (RFC 6265 §5.3 step 11). `total` is unchanged — it is
+        // the same slot.
+        const existing = this.dm.get(domain)?.get(path)?.get(name);
+        if (existing) {
+            this.dm
+                .get(domain)
+                .get(path)
+                .set(name, { ...cookie, createdAt: existing.createdAt });
+            return;
         }
-        else {
-            // New cookie: enforce caps first
-            this.evictForDomain(domain, pm);
-            this.evictGlobal();
-            nm.set(name, cookie);
-            this.total++;
+        // Evict BEFORE this cookie's path map exists.
+        //
+        // Both eviction helpers prune empty path maps as they go, and evictGlobal
+        // can drop a whole domain. Creating the path map up front meant the prune
+        // deleted the map that was about to be written into: the new cookie was
+        // stored into an orphaned map that nothing could reach, so `setCookie`
+        // returned true, the cookie was never sent, `getAll()`/`toJSON()` could
+        // not see it, and `this.total` was incremented regardless. The counter
+        // then drifted above the number of cookies actually held — measured at
+        // `count === 5` with 2 cookies stored — and since evictGlobal() reads
+        // `this.total`, the global cap stopped bounding anything either.
+        this.evictForDomain(domain);
+        this.evictGlobal();
+        // Re-fetch: eviction may have removed this domain, or emptied it, while
+        // the local reference went stale.
+        let pm = this.dm.get(domain);
+        if (!pm) {
+            pm = new Map();
+            this.dm.set(domain, pm);
+        }
+        let nm = pm.get(path);
+        if (!nm) {
+            nm = new Map();
+            pm.set(path, nm);
         }
+        nm.set(name, cookie);
+        this.total++;
     }
     /**
      * Evict the least-recently-accessed cookie from a domain when
      * the per-domain cap is exceeded. Evicts down to maxPerDomain - 1.
      */
-    evictForDomain(_domain, pm) {
+    evictForDomain(domain) {
+        const pm = this.dm.get(domain);
+        if (!pm)
+            return;
         let count = 0;
         for (const nm of pm.values())
             count += nm.size;