tough-cookie 0.10.0 → 0.13.0

package/lib/cookie.js

@@ -1,28 +1,38 @@
-/*
- * Copyright GoInstant, Inc. and other contributors. All rights reserved.
- * Permission is hereby granted, free of charge, to any person obtaining a copy
- * of this software and associated documentation files (the "Software"), to
- * deal in the Software without restriction, including without limitation the
- * rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
- * sell copies of the Software, and to permit persons to whom the Software is
- * furnished to do so, subject to the following conditions:
+/*!
+ * Copyright (c) 2015, Salesforce.com, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
  *
- * The above copyright notice and this permission notice shall be included in
- * all copies or substantial portions of the Software.
+ * 3. Neither the name of Salesforce.com nor the names of its contributors may
+ * be used to endorse or promote products derived from this software without
+ * specific prior written permission.
  *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
- * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
- * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
- * IN THE SOFTWARE.
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
  */
-
-/*jshint regexp:false */
+'use strict';
 var net = require('net');
 var urlParse = require('url').parse;
 var pubsuffix = require('./pubsuffix');
+var Store = require('./store').Store;
 
 var punycode;
 try {
@@ -43,7 +53,13 @@ var COOKIE_OCTETS = new RegExp('^'+COOKIE_OCTET.source+'$');
 
 // The name/key cannot be empty but the value can (S5.2):
 var COOKIE_PAIR_STRICT = new RegExp('^('+TOKEN.source+'+)=("?)('+COOKIE_OCTET.source+'*)\\2$');
-var COOKIE_PAIR = /^([^=\s]+)\s*=\s*("?)\s*(.*)\s*\2\s*$/;
+
+// Double quotes are part of the value (see: S4.1.1).
+// '\r', '\n' and '\0' should be treated as a terminator in the "relaxed" mode
+// (see: https://github.com/ChromiumWebApps/chromium/blob/b3d3b4da8bb94c1b2e061600df106d590fda3620/net/cookies/parsed_cookie.cc#L60)
+// '=' and ';' are attribute/values separators
+// (see: https://github.com/ChromiumWebApps/chromium/blob/b3d3b4da8bb94c1b2e061600df106d590fda3620/net/cookies/parsed_cookie.cc#L64)
+var COOKIE_PAIR = /^([^=;]+)\s*=\s*(("?)[^\n\r\0]*\3)/;
 
 // RFC6265 S4.1.1 defines extension-av as 'any CHAR except CTLs or ";"'
 // Note ';' is \x3B
@@ -54,23 +70,13 @@ var PATH_VALUE = NON_CTL_SEMICOLON;
 // Used for checking whether or not there is a trailing semi-colon
 var TRAILING_SEMICOLON = /;+$/;
 
-/* RFC6265 S5.1.1.5:
- * [fail if] the day-of-month-value is less than 1 or greater than 31
- */
-var DAY_OF_MONTH = /^(0?[1-9]|[12][0-9]|3[01])$/;
+var DAY_OF_MONTH = /^(\d{1,2})[^\d]*$/;
+var TIME = /^(\d{1,2})[^\d]*:(\d{1,2})[^\d]*:(\d{1,2})[^\d]*$/;
+var MONTH = /^(Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)/i;
 
-/* RFC6265 S5.1.1.5:
- * [fail if]
- * *  the hour-value is greater than 23,
- * *  the minute-value is greater than 59, or
- * *  the second-value is greater than 59.
- */
-var TIME = /(0?[0-9]|1[0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9])/;
-var STRICT_TIME = /^(0?[0-9]|1[0-9]|2[0-3]):([0-5][0-9]):([0-5][0-9])$/;
-
-var MONTH = /^(Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)$/i;
 var MONTH_TO_NUM = {
-  jan:0, feb:1, mar:2, apr:3, may:4, jun:5, jul:6, aug:7, sep:8, oct:9, nov:10, dec:11
+  jan:0, feb:1, mar:2, apr:3, may:4, jun:5,
+  jul:6, aug:7, sep:8, oct:9, nov:10, dec:11
 };
 var NUM_TO_MONTH = [
   'Jan','Feb','Mar','Apr','May','Jun','Jul','Aug','Sep','Oct','Nov','Dec'
@@ -79,32 +85,44 @@ var NUM_TO_DAY = [
   'Sun','Mon','Tue','Wed','Thu','Fri','Sat'
 ];
 
-var YEAR = /^([1-9][0-9]{1,3})$/; // 2 to 4 digits (will check range when parsing)
+var YEAR = /^(\d{2}|\d{4})$/; // 2 to 4 digits
 
 var MAX_TIME = 2147483647000; // 31-bit max
-var MAX_DATE = new Date(CookieJar.MAX_TIME); // 31-bit max
 var MIN_TIME = 0; // 31-bit min
-var MIN_DATE = new Date(CookieJar.MIN_TIME); // 31-bit min
+
+var cookiesCreated = 0; // Number of cookies created in runtime
 
 
 // RFC6265 S5.1.1 date parser:
 function parseDate(str,strict) {
-  if (!str) return;
-  var found_time, found_dom, found_month, found_year;
+  if (!str) {
+    return;
+  }
 
   /* RFC6265 S5.1.1:
    * 2. Process each date-token sequentially in the order the date-tokens
    * appear in the cookie-date
    */
   var tokens = str.split(DATE_DELIM);
-  if (!tokens) return;
+  if (!tokens) {
+    return;
+  }
+
+  var hour = null;
+  var minutes = null;
+  var seconds = null;
+  var day = null;
+  var month = null;
+  var year = null;
 
   var date = new Date();
   date.setMilliseconds(0);
 
   for (var i=0; i<tokens.length; i++) {
     var token = tokens[i].trim();
-    if (!token.length) continue;
+    if (!token.length) {
+      continue;
+    }
 
     var result;
 
@@ -114,13 +132,22 @@ function parseDate(str,strict) {
      * the date-token, respectively.  Skip the remaining sub-steps and continue
      * to the next date-token.
      */
-    if (!found_time) {
-      result = (strict ? STRICT_TIME : TIME).exec(token);
+    if (seconds === null) {
+      result = TIME.exec(token);
       if (result) {
-        found_time = true;
-        date.setUTCHours(result[1]);
-        date.setUTCMinutes(result[2]);
-        date.setUTCSeconds(result[3]);
+        hour = parseInt(result[1], 10);
+        minutes = parseInt(result[2], 10);
+        seconds = parseInt(result[3], 10);
+        /* RFC6265 S5.1.1.5:
+         * [fail if]
+         * *  the hour-value is greater than 23,
+         * *  the minute-value is greater than 59, or
+         * *  the second-value is greater than 59.
+         */
+        if(hour > 23 || minutes > 59 || seconds > 59) {
+          return;
+        }
+
         continue;
       }
     }
@@ -130,11 +157,16 @@ function parseDate(str,strict) {
      * the day-of-month-value to the number denoted by the date-token.  Skip
      * the remaining sub-steps and continue to the next date-token.
      */
-    if (!found_dom) {
+    if (day === null) {
       result = DAY_OF_MONTH.exec(token);
       if (result) {
-        found_dom = true;
-        date.setUTCDate(result[1]);
+        day = parseInt(result, 10);
+        /* RFC6265 S5.1.1.5:
+         * [fail if] the day-of-month-value is less than 1 or greater than 31
+         */
+        if(day < 1 || day > 31) {
+          return;
+        }
         continue;
       }
     }
@@ -144,11 +176,10 @@ function parseDate(str,strict) {
      * the month denoted by the date-token.  Skip the remaining sub-steps and
      * continue to the next date-token.
      */
-    if (!found_month) {
+    if (month === null) {
       result = MONTH.exec(token);
       if (result) {
-        found_month = true;
-        date.setUTCMonth(MONTH_TO_NUM[result[1].toLowerCase()]);
+        month = MONTH_TO_NUM[result[1].toLowerCase()];
         continue;
       }
     }
@@ -158,37 +189,36 @@ function parseDate(str,strict) {
      * denoted by the date-token.  Skip the remaining sub-steps and continue to
      * the next date-token.
      */
-    if (!found_year) {
+    if (year === null) {
       result = YEAR.exec(token);
       if (result) {
-        var year = result[0];
+        year = parseInt(result[0], 10);
         /* From S5.1.1:
          * 3.  If the year-value is greater than or equal to 70 and less
          * than or equal to 99, increment the year-value by 1900.
          * 4.  If the year-value is greater than or equal to 0 and less
          * than or equal to 69, increment the year-value by 2000.
          */
-        if (70 <= year && year <= 99)
+        if (70 <= year && year <= 99) {
           year += 1900;
-        else if (0 <= year && year <= 69)
+        } else if (0 <= year && year <= 69) {
           year += 2000;
+        }
 
-        if (year < 1601)
+        if (year < 1601) {
           return; // 5. ... the year-value is less than 1601
-
-        found_year = true;
-        date.setUTCFullYear(year);
+        }
         continue;
       }
     }
   }
 
-  if (!(found_time && found_dom && found_month && found_year)) {
+  if (seconds === null || day === null || month === null || year === null) {
     return; // 5. ... at least one of the found-day-of-month, found-month, found-
             // year, or found-time flags is not set,
   }
 
-  return date;
+  return new Date(Date.UTC(year, month, day, hour, minutes, seconds));
 }
 
 function formatDate(date) {
@@ -203,19 +233,24 @@ function formatDate(date) {
 
 // S5.1.2 Canonicalized Host Names
 function canonicalDomain(str) {
-  if (str == null) return null;
+  if (str == null) {
+    return null;
+  }
   str = str.trim().replace(/^\./,''); // S4.1.2.3 & S5.2.3: ignore leading .
 
   // convert to IDN if any non-ASCII characters
-  if (punycode && /[^\u0001-\u007f]/.test(str))
+  if (punycode && /[^\u0001-\u007f]/.test(str)) {
     str = punycode.toASCII(str);
+  }
 
   return str.toLowerCase();
 }
 
 // S5.1.3 Domain Matching
 function domainMatch(str, domStr, canonicalize) {
-  if (str == null || domStr == null) return null;
+  if (str == null || domStr == null) {
+    return null;
+  }
   if (canonicalize !== false) {
     str = canonicalDomain(str);
     domStr = canonicalDomain(domStr);
@@ -226,25 +261,35 @@ function domainMatch(str, domStr, canonicalize) {
    * domain string and the string will have been canonicalized to lower case at
    * this point)"
    */
-  if (str == domStr) return true;
+  if (str == domStr) {
+    return true;
+  }
 
   /* "All of the following [three] conditions hold:" (order adjusted from the RFC) */
 
   /* "* The string is a host name (i.e., not an IP address)." */
-  if (net.isIP(str)) return false;
+  if (net.isIP(str)) {
+    return false;
+  }
 
   /* "* The domain string is a suffix of the string" */
   var idx = str.indexOf(domStr);
-  if (idx <= 0) return false; // it's a non-match (-1) or prefix (0)
+  if (idx <= 0) {
+    return false; // it's a non-match (-1) or prefix (0)
+  }
 
   // e.g "a.b.c".indexOf("b.c") === 2
   // 5 === 3+2
-  if (str.length !== domStr.length + idx) // it's not a suffix
+  if (str.length !== domStr.length + idx) { // it's not a suffix
     return false;
+  }
 
   /* "* The last character of the string that is not included in the domain
   * string is a %x2E (".") character." */
-  if (str.substr(idx-1,1) !== '.') return false;
+  if (str.substr(idx-1,1) !== '.') {
+    return false;
+  }
+
   return true;
 }
 
@@ -260,14 +305,20 @@ function domainMatch(str, domStr, canonicalize) {
 function defaultPath(path) {
   // "2. If the uri-path is empty or if the first character of the uri-path is not
   // a %x2F ("/") character, output %x2F ("/") and skip the remaining steps.
-  if (!path || path.substr(0,1) !== "/") return "/";
+  if (!path || path.substr(0,1) !== "/") {
+    return "/";
+  }
 
   // "3. If the uri-path contains no more than one %x2F ("/") character, output
   // %x2F ("/") and skip the remaining step."
-  if (path === "/") return path;
+  if (path === "/") {
+    return path;
+  }
 
   var rightSlash = path.lastIndexOf("/");
-  if (rightSlash === 0) return "/";
+  if (rightSlash === 0) {
+    return "/";
+  }
 
   // "4. Output the characters of the uri-path from the first character up to,
   // but not including, the right-most %x2F ("/")."
@@ -280,21 +331,24 @@ function defaultPath(path) {
  */
 function pathMatch(reqPath,cookiePath) {
   // "o  The cookie-path and the request-path are identical."
-  if (cookiePath === reqPath)
+  if (cookiePath === reqPath) {
     return true;
+  }
 
   var idx = reqPath.indexOf(cookiePath);
   if (idx === 0) {
     // "o  The cookie-path is a prefix of the request-path, and the last
     // character of the cookie-path is %x2F ("/")."
-    if (cookiePath.substr(-1) === "/")
+    if (cookiePath.substr(-1) === "/") {
       return true;
+    }
 
     // " o  The cookie-path is a prefix of the request-path, and the first
     // character of the request-path that is not included in the cookie- path
     // is a %x2F ("/") character."
-    if (reqPath.substr(cookiePath.length,1) === "/")
+    if (reqPath.substr(cookiePath.length,1) === "/") {
       return true;
+    }
   }
 
   return false;
@@ -307,7 +361,9 @@ function parse(str, strict) {
   // If we are not in strict mode we remove the trailing semi-colons.
   var semiColonCheck = TRAILING_SEMICOLON.exec(str);
   if (semiColonCheck) {
-    if (strict) return;
+    if (strict) {
+      return;
+    }
     str = str.slice(0, semiColonCheck.index);
   }
 
@@ -318,13 +374,19 @@ function parse(str, strict) {
 
   // Rx satisfies the "the name string is empty" and "lacks a %x3D ("=")"
   // constraints as well as trimming any whitespace.
-  if (!result) return;
+  if (!result) {
+    return;
+  }
 
   var c = new Cookie();
   c.key = result[1]; // the regexp should trim() already
-  c.value = result[3]; // [2] is quotes or empty-string
+  c.value = strict ? result[3] : result[2]; // [2] is quotes or empty-string in strict mode
+  c.key = c.key.trim();
+  c.value = c.value.trim();
 
-  if (firstSemi === -1) return c;
+  if (firstSemi === -1) {
+    return c;
+  }
 
   // S5.2.3 "unparsed-attributes consist of the remainder of the set-cookie-string
   // (including the %x3B (";") in question)." plus later on in the same section
@@ -333,7 +395,9 @@ function parse(str, strict) {
 
   // "If the unparsed-attributes string is empty, skip the rest of these
   // steps."
-  if (unparsed.length === 0) return c;
+  if (unparsed.length === 0) {
+    return c;
+  }
 
   /*
    * S5.2 says that when looping over the items "[p]rocess the attribute-name
@@ -347,7 +411,9 @@ function parse(str, strict) {
   while (cookie_avs.length) {
     var av = cookie_avs.shift();
 
-    if (strict && !EXTENSION_AV.test(av)) return;
+    if (strict && !EXTENSION_AV.test(av)) {
+      return;
+    }
 
     var av_sep = av.indexOf('=');
     var av_key, av_value;
@@ -360,28 +426,32 @@ function parse(str, strict) {
     }
 
     av_key = av_key.trim().toLowerCase();
-    if (av_value) av_value = av_value.trim();
+    if (av_value) {
+      av_value = av_value.trim();
+    }
 
     switch(av_key) {
     case 'expires': // S5.2.1
-      if (!av_value) { if(strict){return}else{break;} }
+      if (!av_value) {if(strict){return;}else{break;} }
       var exp = parseDate(av_value,strict);
       // "If the attribute-value failed to parse as a cookie date, ignore the
       // cookie-av."
-      if (exp == null) { if(strict){return}else{break;} }
+      if (exp == null) { if(strict){return;}else{break;} }
       c.expires = exp;
       // over and underflow not realistically a concern: V8's getTime() seems to
       // store something larger than a 32-bit time_t (even with 32-bit node)
       break;
 
     case 'max-age': // S5.2.2
-      if (!av_value) { if(strict){return}else{break;} }
+      if (!av_value) { if(strict){return;}else{break;} }
       // "If the first character of the attribute-value is not a DIGIT or a "-"
       // character ...[or]... If the remainder of attribute-value contains a
       // non-DIGIT character, ignore the cookie-av."
-      if (!/^-?[0-9]+$/.test(av_value)) { if(strict){return}else{break;} }
+      if (!/^-?[0-9]+$/.test(av_value)) { if(strict){return;}else{break;} }
       var delta = parseInt(av_value,10);
-      if (strict && delta <= 0) return; // S4.1.1
+      if (strict && delta <= 0) {
+        return; // S4.1.1
+      }
       // "If delta-seconds is less than or equal to zero (0), let expiry-time
       // be the earliest representable date and time."
       c.setMaxAge(delta);
@@ -390,11 +460,11 @@ function parse(str, strict) {
     case 'domain': // S5.2.3
       // "If the attribute-value is empty, the behavior is undefined.  However,
       // the user agent SHOULD ignore the cookie-av entirely."
-      if (!av_value) { if(strict){return}else{break;} }
+      if (!av_value) { if(strict){return;}else{break;} }
       // S5.2.3 "Let cookie-domain be the attribute-value without the leading %x2E
       // (".") character."
       var domain = av_value.trim().replace(/^\./,'');
-      if (!domain) { if(strict){return}else{break;} } // see "is empty" above
+      if (!domain) { if(strict){return;}else{break;} } // see "is empty" above
       // "Convert the cookie-domain to lower case."
       c.domain = domain.toLowerCase();
       break;
@@ -410,7 +480,10 @@ function parse(str, strict) {
        * We'll represent the default-path as null since it depends on the
        * context of the parsing.
        */
-      if (!av_value || av_value.substr(0,1) != "/") { if(strict){return}else{break;} }
+      if (!av_value || av_value.substr(0,1) != "/") {
+        c.path = null;
+        if(strict){return;}else{break;}
+      }
       c.path = av_value;
       break;
 
@@ -420,12 +493,12 @@ function parse(str, strict) {
        * the user agent MUST append an attribute to the cookie-attribute-list
        * with an attribute-name of Secure and an empty attribute-value."
        */
-      if (av_value != null) { if(strict){return} }
+      if (av_value != null) { if(strict){return;} }
       c.secure = true;
       break;
 
     case 'httponly': // S5.2.6 -- effectively the same as 'secure'
-      if (av_value != null) { if(strict){return} }
+      if (av_value != null) { if(strict){return;} }
       c.httpOnly = true;
       break;
 
@@ -438,11 +511,17 @@ function parse(str, strict) {
 
   // ensure a default date for sorting:
   c.creation = new Date();
+  //NOTE: add runtime index for the cookieCompare() to resolve the situation when Date's precision is not enough .
+  //Store initial UTC time as well, so we will be able to determine if we need to fallback to the Date object.
+  c._creationRuntimeIdx = ++cookiesCreated;
+  c._initialCreationTime = c.creation.getTime();
   return c;
 }
 
 function fromJSON(str) {
-  if (!str) return null;
+  if (!str) {
+    return null;
+  }
 
   var obj;
   try {
@@ -454,7 +533,9 @@ function fromJSON(str) {
   var c = new Cookie();
   for (var i=0; i<numCookieProperties; i++) {
     var prop = cookieProperties[i];
-    if (obj[prop] == null) continue;
+    if (obj[prop] == null) {
+      continue;
+    }
     if (prop === 'expires' ||
         prop === 'creation' ||
         prop === 'lastAccessed')
@@ -484,18 +565,33 @@ function fromJSON(str) {
 function cookieCompare(a,b) {
   // descending for length: b CMP a
   var deltaLen = (b.path ? b.path.length : 0) - (a.path ? a.path.length : 0);
-  if (deltaLen !== 0) return deltaLen;
+  if (deltaLen !== 0) {
+    return deltaLen;
+  }
+
+  var aTime = a.creation ? a.creation.getTime() : MAX_TIME;
+  var bTime = b.creation ? b.creation.getTime() : MAX_TIME;
+
+  // NOTE: if creation dates are equal and they were not modified from the outside,
+  // then use _creationRuntimeIdx for the comparison.
+  if(aTime === bTime && aTime === a._initialCreationTime && bTime === b._initialCreationTime) {
+    return a._creationRuntimeIdx - b._creationRuntimeIdx;
+  }
+
   // ascending for time: a CMP b
-  return (a.creation ? a.creation.getTime() : MAX_TIME) -
-         (b.creation ? b.creation.getTime() : MAX_TIME);
+  return aTime - bTime;
 }
 
 // Gives the permutation of all possible domainMatch()es of a given domain. The
 // array is in shortest-to-longest order.  Handy for indexing.
 function permuteDomain(domain) {
   var pubSuf = pubsuffix.getPublicSuffix(domain);
-  if (!pubSuf) return null;
-  if (pubSuf == domain) return [domain];
+  if (!pubSuf) {
+    return null;
+  }
+  if (pubSuf == domain) {
+    return [domain];
+  }
 
   var prefix = domain.slice(0,-(pubSuf.length+1)); // ".example.com"
   var parts = prefix.split('.').reverse();
@@ -511,14 +607,18 @@ function permuteDomain(domain) {
 // Gives the permutation of all possible pathMatch()es of a given path. The
 // array is in longest-to-shortest order.  Handy for indexing.
 function permutePath(path) {
-  var origPath = path;
-  if (path === '/') return ['/'];
-  if (path.lastIndexOf('/') === path.length-1)
+  if (path === '/') {
+    return ['/'];
+  }
+  if (path.lastIndexOf('/') === path.length-1) {
     path = path.substr(0,path.length-1);
+  }
   var permutations = [path];
   while (path.length > 1) {
     var lindex = path.lastIndexOf('/');
-    if (lindex === 0) break;
+    if (lindex === 0) {
+      break;
+    }
     path = path.substr(0,lindex);
     permutations.push(path);
   }
@@ -526,9 +626,14 @@ function permutePath(path) {
   return permutations;
 }
 
+function getCookieContext(url) {
+  return (url instanceof Object) ? url : urlParse(decodeURI(url));
+}
 
 function Cookie (opts) {
-  if (typeof opts !== "object") return;
+  if (typeof opts !== "object") {
+    return;
+  }
   Object.keys(opts).forEach(function (key) {
     if (Cookie.prototype.hasOwnProperty(key)) {
       this[key] = opts[key] || Cookie.prototype[key];
@@ -555,10 +660,14 @@ Cookie.prototype.extensions = null;
 Cookie.prototype.hostOnly = null; // boolean when set
 Cookie.prototype.pathIsDefault = null; // boolean when set
 Cookie.prototype.creation = null; // Date when set; defaulted by Cookie.parse
+Cookie.prototype._initialCreationTime = null; // Used to determine if cookie.creation was modified
+Cookie.prototype._creationRuntimeIdx = null; // Runtime index of the created cookie, used in cookieCompare()
 Cookie.prototype.lastAccessed = null; // Date when set
 
 var cookieProperties = Object.freeze(Object.keys(Cookie.prototype).map(function(p) {
-  if (p instanceof Function) return;
+  if (p instanceof Function) {
+    return;
+  }
   return p;
 }));
 var numCookieProperties = cookieProperties.length;
@@ -573,42 +682,54 @@ Cookie.prototype.inspect = function inspect() {
 };
 
 Cookie.prototype.validate = function validate() {
-  if (!COOKIE_OCTETS.test(this.value))
+  if (!COOKIE_OCTETS.test(this.value)) {
     return false;
-  if (this.expires != Infinity && !(this.expires instanceof Date) && !parseDate(this.expires,true))
+  }
+  if (this.expires != Infinity && !(this.expires instanceof Date) && !parseDate(this.expires,true)) {
     return false;
-  if (this.maxAge != null && this.maxAge <= 0)
+  }
+  if (this.maxAge != null && this.maxAge <= 0) {
     return false; // "Max-Age=" non-zero-digit *DIGIT
-  if (this.path != null && !PATH_VALUE.test(this.path))
+  }
+  if (this.path != null && !PATH_VALUE.test(this.path)) {
     return false;
+  }
 
   var cdomain = this.cdomain();
   if (cdomain) {
-    if (cdomain.match(/\.$/))
+    if (cdomain.match(/\.$/)) {
       return false; // S4.1.2.3 suggests that this is bad. domainMatch() tests confirm this
+    }
     var suffix = pubsuffix.getPublicSuffix(cdomain);
-    if (suffix == null) // it's a public suffix
+    if (suffix == null) { // it's a public suffix
       return false;
+    }
   }
   return true;
 };
 
 Cookie.prototype.setExpires = function setExpires(exp) {
-  if (exp instanceof Date) this.expires = exp;
-  else this.expires = parseDate(exp) || "Infinity";
+  if (exp instanceof Date) {
+    this.expires = exp;
+  } else {
+    this.expires = parseDate(exp) || "Infinity";
+  }
 };
 
 Cookie.prototype.setMaxAge = function setMaxAge(age) {
-  if (age === Infinity || age === -Infinity)
+  if (age === Infinity || age === -Infinity) {
     this.maxAge = age.toString(); // so JSON.stringify() works
-  else
+  } else {
     this.maxAge = age;
+  }
 };
 
 // gives Cookie header format
 Cookie.prototype.cookieString = function cookieString() {
   var val = this.value;
-  if (val == null) val = '';
+  if (val == null) {
+    val = '';
+  }
   return this.key+'='+val;
 };
 
@@ -617,22 +738,30 @@ Cookie.prototype.toString = function toString() {
   var str = this.cookieString();
 
   if (this.expires != Infinity) {
-    if (this.expires instanceof Date)
+    if (this.expires instanceof Date) {
       str += '; Expires='+formatDate(this.expires);
-    else
+    } else {
       str += '; Expires='+this.expires;
+    }
   }
 
-  if (this.maxAge != null && this.maxAge != Infinity)
+  if (this.maxAge != null && this.maxAge != Infinity) {
     str += '; Max-Age='+this.maxAge;
+  }
 
-  if (this.domain && !this.hostOnly)
+  if (this.domain && !this.hostOnly) {
     str += '; Domain='+this.domain;
-  if (this.path)
+  }
+  if (this.path) {
     str += '; Path='+this.path;
+  }
 
-  if (this.secure) str += '; Secure';
-  if (this.httpOnly) str += '; HttpOnly';
+  if (this.secure) {
+    str += '; Secure';
+  }
+  if (this.httpOnly) {
+    str += '; HttpOnly';
+  }
   if (this.extensions) {
     this.extensions.forEach(function(ext) {
       str += '; '+ext;
@@ -662,8 +791,9 @@ Cookie.prototype.TTL = function TTL(now) {
       expires = parseDate(expires) || Infinity;
     }
 
-    if (expires == Infinity)
+    if (expires == Infinity) {
       return Infinity;
+    }
 
     return expires.getTime() - (now || Date.now());
   }
@@ -680,7 +810,9 @@ Cookie.prototype.expiryTime = function expiryTime(now) {
     return relativeTo.getTime() + age;
   }
 
-  if (this.expires == Infinity) return Infinity;
+  if (this.expires == Infinity) {
+    return Infinity;
+  }
   return this.expires.getTime();
 };
 
@@ -688,9 +820,13 @@ Cookie.prototype.expiryTime = function expiryTime(now) {
 // elsewhere), except it returns a Date
 Cookie.prototype.expiryDate = function expiryDate(now) {
   var millisec = this.expiryTime(now);
-  if (millisec == Infinity) return new Date(MAX_TIME);
-  else if (millisec == -Infinity) return new Date(MIN_TIME);
-  else return new Date(millisec);
+  if (millisec == Infinity) {
+    return new Date(MAX_TIME);
+  } else if (millisec == -Infinity) {
+    return new Date(MIN_TIME);
+  } else {
+    return new Date(millisec);
+  }
 };
 
 // This replaces the "persistent-flag" parts of S5.3 step 3
@@ -701,14 +837,19 @@ Cookie.prototype.isPersistent = function isPersistent() {
 // Mostly S5.1.2 and S5.2.3:
 Cookie.prototype.cdomain =
 Cookie.prototype.canonicalizedDomain = function canonicalizedDomain() {
-  if (this.domain == null) return null;
+  if (this.domain == null) {
+    return null;
+  }
   return canonicalDomain(this.domain);
 };
 
 
 var memstore;
 function CookieJar(store, rejectPublicSuffixes) {
-  if (rejectPublicSuffixes != null) this.rejectPublicSuffixes = rejectPublicSuffixes;
+  if (rejectPublicSuffixes != null) {
+    this.rejectPublicSuffixes = rejectPublicSuffixes;
+  }
+
   if (!store) {
     memstore = memstore || require('./memstore');
     store = new memstore.MemoryCookieStore();
@@ -717,10 +858,12 @@ function CookieJar(store, rejectPublicSuffixes) {
 }
 CookieJar.prototype.store = null;
 CookieJar.prototype.rejectPublicSuffixes = true;
+var CAN_BE_SYNC = [];
 
-CookieJar.prototype.setCookie = function setCookie(cookie, url, options, cb) {
+CAN_BE_SYNC.push('setCookie');
+CookieJar.prototype.setCookie = function(cookie, url, options, cb) {
   var err;
-  var context = (url instanceof Object) ? url : urlParse(url);
+  var context = getCookieContext(url);
   if (options instanceof Function) {
     cb = options;
     options = {};
@@ -729,8 +872,9 @@ CookieJar.prototype.setCookie = function setCookie(cookie, url, options, cb) {
   var host = canonicalDomain(context.hostname);
 
   // S5.3 step 1
-  if (!(cookie instanceof Cookie))
+  if (!(cookie instanceof Cookie)) {
     cookie = Cookie.parse(cookie, options.strict === true);
+  }
   if (!cookie) {
     err = new Error("Cookie failed to parse");
     return cb(options.ignoreError ? null : err);
@@ -759,22 +903,21 @@ CookieJar.prototype.setCookie = function setCookie(cookie, url, options, cb) {
       return cb(options.ignoreError ? null : err);
     }
 
-    if (cookie.hostOnly == null) // don't reset if already set
+    if (cookie.hostOnly == null) { // don't reset if already set
       cookie.hostOnly = false;
+    }
 
   } else {
     cookie.hostOnly = true;
     cookie.domain = host;
   }
 
-  // S5.3 step 7: "Otherwise, set the cookie's path to the default-path of the
-  // request-uri"
-  if (!cookie.path) {
+  //S5.2.4 If the attribute-value is empty or if the first character of the
+  //attribute-value is not %x2F ("/"):
+  //Let cookie-path be the default-path.
+  if (!cookie.path || cookie.path[0] !== '/') {
     cookie.path = defaultPath(context.pathname);
     cookie.pathIsDefault = true;
-  } else {
-    if (cookie.path.length > 1 && cookie.path.substr(-1) == '/')
-      cookie.path = cookie.path.slice(0,-1);
   }
 
   // S5.3 step 8: NOOP; secure attribute
@@ -789,17 +932,22 @@ CookieJar.prototype.setCookie = function setCookie(cookie, url, options, cb) {
   var store = this.store;
 
   if (!store.updateCookie) {
-    store.updateCookie = function stubUpdateCookie(oldCookie, newCookie, cb) {
+    store.updateCookie = function(oldCookie, newCookie, cb) {
       this.putCookie(newCookie, cb);
     };
   }
 
-  store.findCookie(cookie.domain, cookie.path, cookie.key, function(err,oldCookie) {
-    if (err) return cb(err);
+  function withCookie(err, oldCookie) {
+    if (err) {
+      return cb(err);
+    }
 
     var next = function(err) {
-      if (err) return cb(err);
-      else cb(null, cookie);
+      if (err) {
+        return cb(err);
+      } else {
+        cb(null, cookie);
+      }
     };
 
     if (oldCookie) {
@@ -818,12 +966,15 @@ CookieJar.prototype.setCookie = function setCookie(cookie, url, options, cb) {
       cookie.creation = cookie.lastAccessed = now;
       store.putCookie(cookie, next); // step 12
     }
-  });
+  }
+
+  store.findCookie(cookie.domain, cookie.path, cookie.key, withCookie);
 };
 
 // RFC6365 S5.4
-CookieJar.prototype.getCookies = function getCookies(url, options, cb) {
-  var context = (url instanceof Object) ? url : urlParse(url);
+CAN_BE_SYNC.push('getCookies');
+CookieJar.prototype.getCookies = function(url, options, cb) {
+  var context = getCookieContext(url);
   if (options instanceof Function) {
     cb = options;
     options = {};
@@ -840,7 +991,9 @@ CookieJar.prototype.getCookies = function getCookies(url, options, cb) {
   }
 
   var http = options.http;
-  if (http == null) http = true;
+  if (http == null) {
+    http = true;
+  }
 
   var now = options.now || Date.now();
   var expireCheck = options.expire !== false;
@@ -855,24 +1008,31 @@ CookieJar.prototype.getCookies = function getCookies(url, options, cb) {
     //   The cookie's host-only-flag is false and the canonicalized
     //   request-host domain-matches the cookie's domain."
     if (c.hostOnly) {
-      if (c.domain != host) return false;
+      if (c.domain != host) {
+        return false;
+      }
     } else {
-      if (!domainMatch(host, c.domain, false)) return false;
+      if (!domainMatch(host, c.domain, false)) {
+        return false;
+      }
     }
 
     // "The request-uri's path path-matches the cookie's path."
-    if (!allPaths && !pathMatch(path, c.path))
+    if (!allPaths && !pathMatch(path, c.path)) {
       return false;
+    }
 
     // "If the cookie's secure-only-flag is true, then the request-uri's
     // scheme must denote a "secure" protocol"
-    if (c.secure && !secure)
+    if (c.secure && !secure) {
       return false;
+    }
 
     // "If the cookie's http-only-flag is true, then exclude the cookie if the
     // cookie-string is being generated for a "non-HTTP" API"
-    if (c.httpOnly && !http)
+    if (c.httpOnly && !http) {
       return false;
+    }
 
     // deferred from S5.3
     // non-RFC: allow retention of expired cookies by choice
@@ -885,50 +1045,96 @@ CookieJar.prototype.getCookies = function getCookies(url, options, cb) {
   }
 
   store.findCookies(host, allPaths ? null : path, function(err,cookies) {
-    if (err) return cb(err);
+    if (err) {
+      return cb(err);
+    }
 
     cookies = cookies.filter(matchingCookie);
 
     // sorting of S5.4 part 2
-    if (options.sort !== false)
+    if (options.sort !== false) {
       cookies = cookies.sort(cookieCompare);
+    }
 
     // S5.4 part 3
     var now = new Date();
-    cookies.forEach(function(c) { c.lastAccessed = now });
+    cookies.forEach(function(c) {
+      c.lastAccessed = now;
+    });
     // TODO persist lastAccessed
 
     cb(null,cookies);
   });
 };
 
+CAN_BE_SYNC.push('getCookieString');
 CookieJar.prototype.getCookieString = function(/*..., cb*/) {
   var args = Array.prototype.slice.call(arguments,0);
   var cb = args.pop();
   var next = function(err,cookies) {
-    if (err) cb(err);
-    else cb(null, cookies.map(function(c){return c.cookieString()}).join('; '));
+    if (err) {
+      cb(err);
+    } else {
+      cb(null, cookies
+        .sort(cookieCompare)
+        .map(function(c){
+          return c.cookieString();
+        })
+        .join('; '));
+    }
   };
   args.push(next);
   this.getCookies.apply(this,args);
 };
 
+CAN_BE_SYNC.push('getSetCookieStrings');
 CookieJar.prototype.getSetCookieStrings = function(/*..., cb*/) {
   var args = Array.prototype.slice.call(arguments,0);
   var cb = args.pop();
   var next = function(err,cookies) {
-    if (err) cb(err);
-    else cb(null, cookies.map(function(c){return c.toString()}));
+    if (err) {
+      cb(err);
+    } else {
+      cb(null, cookies.map(function(c){
+        return c.toString();
+      }));
+    }
   };
   args.push(next);
   this.getCookies.apply(this,args);
 };
 
+// Use a closure to provide a true imperative API for synchronous stores.
+function syncWrap(method) {
+  return function() {
+    if (!this.store.synchronous) {
+      throw new Error('CookieJar store is not synchronous; use async API instead.');
+    }
+
+    var args = Array.prototype.slice.call(arguments);
+    var syncErr, syncResult;
+    args.push(function syncCb(err, result) {
+      syncErr = err;
+      syncResult = result;
+    });
+    this[method].apply(this, args);
+
+    if (syncErr) {
+      throw syncErr;
+    }
+    return syncResult;
+  };
+}
 
+// wrap all declared CAN_BE_SYNC methods in the sync wrapper
+CAN_BE_SYNC.forEach(function(method) {
+  CookieJar.prototype[method+'Sync'] = syncWrap(method);
+});
 
 module.exports = {
   CookieJar: CookieJar,
   Cookie: Cookie,
+  Store: Store,
   parseDate: parseDate,
   formatDate: formatDate,
   parse: parse,