tough-cookie 0.9.11 → 0.9.15

package/.jshintrc

@@ -0,0 +1,72 @@
+{
+    // Settings
+    "passfail"      : false,  // Stop on first error.
+    "maxerr"        : 100,    // Maximum error before stopping.
+
+
+    // Predefined globals whom JSHint will ignore.
+    "browser"       : false,   // Standard browser globals e.g. `window`, `document`.
+    "node"          : true,
+    "rhino"         : false,
+    "couch"         : false,
+    "wsh"           : false,  // Windows Scripting Host.
+
+    "jquery"        : false,
+    "prototypejs"   : false,
+    "mootools"      : false,
+    "dojo"          : false,
+
+    "predef"        : [  // Custom globals.
+        "escape", "unescape"  // aren't picked up by node flag above :/
+    ],
+
+
+    // Development.
+    "debug"         : false,  // Allow debugger statements e.g. browser breakpoints.
+    "devel"         : false,  // Allow developments statements e.g. `console.log();`.
+
+
+    // EcmaScript 5.
+    "es5"           : true,   // Allow EcmaScript 5 syntax.
+    "esnext"        : true,   // Allow ES "next" syntax, specifically 'const' (V8 has this)
+    "strict"        : false,  // Require `use strict` pragma  in every file.
+    "globalstrict"  : false,  // Allow global "use strict" (also enables 'strict').
+
+
+    // The Good Parts.
+    "asi"           : false,  // Tolerate Automatic Semicolon Insertion (no semicolons).
+    "laxbreak"      : false,  // Tolerate unsafe line breaks e.g. `return [\n] x` without semicolons.
+    "bitwise"       : true,   // Prohibit bitwise operators (&, |, ^, etc.).
+    "boss"          : false,  // Tolerate assignments inside if, for & while. Usually conditions & loops are for comparison, not assignments.
+    "curly"         : false,  // Require {} for every new block or scope.
+    "eqeqeq"        : false,  // Require triple equals i.e. `===`.
+    "eqnull"        : true,   // Tolerate use of `== null`.
+    "evil"          : false,  // Tolerate use of `eval`.
+    "expr"          : true,   // Tolerate `ExpressionStatement` as Programs.
+    "forin"         : false,  // Tolerate `for in` loops without `hasOwnPrototype`.
+    "immed"         : true,   // Require immediate invocations to be wrapped in parens e.g. `( function(){}() );`
+    "latedef"       : false,  // Prohibit variable use before definition.
+    "loopfunc"      : false,  // Allow functions to be defined within loops.
+    "noarg"         : true,   // Prohibit use of `arguments.caller` and `arguments.callee`.
+    "regexp"        : true,   // Prohibit `.` and `[^...]` in regular expressions.
+    "regexdash"     : false,  // Tolerate unescaped last dash i.e. `[-...]`.
+    "scripturl"     : true,   // Tolerate script-targeted URLs.
+    "shadow"        : false,  // Allows re-define variables later in code e.g. `var x=1; x=2;`.
+    "supernew"      : false,  // Tolerate `new function () { ... };` and `new Object;`.
+    "undef"         : true,   // Require all non-global variables be declared before they are used.
+
+
+    // Personal styling prefrences.
+    "lastsemic"     : true,   // Prohibit missing semicolon for the last statement in a one-line block
+    "newcap"        : false,  // Require capitalization of all constructor functions e.g. `new F()`.
+    "noempty"       : true,   // Prohipit use of empty blocks.
+    "nonew"         : true,   // Prohibit use of constructors for side-effects.
+    "nomen"         : false,  // Prohibit use of initial or trailing underbars in names.
+    "onevar"        : false,  // Allow only one `var` statement per function.
+    "onecase"       : false,  // Allow switches with one case statement
+    "plusplus"      : false,  // Prohibit use of `++` & `--`.
+    "proto"         : false,  // Allow use of __proto__
+    "sub"           : true,   // Tolerate all forms of subscript notation besides dot notation e.g. `dict['key']` instead of `dict.key`.
+    "trailing"      : true,   // Prohibit trailing whitespaces.
+    "white"         : false   // Check against strict whitespace and indentation rules.
+}

package/README.md

@@ -272,6 +272,7 @@ The `options` object can be omitted and can have the following properties:
   * _secure_ - boolean - autodetect from url - indicates if this is a "Secure" API.  If the currentUrl starts with `https:` or `wss:` then this is defaulted to `true`, otherwise `false`.
   * _now_ - Date - default `new Date()` - what to use for the creation/access time of cookies
   * _expire_ - boolean - default `true` - perform expiry-time checking of cookies and asynchronously remove expired cookies from the store.  Using `false` will return expired cookies and **not** remove them from the store (which is useful for replaying Set-Cookie headers, potentially).
+  * _allPaths_ - boolean - default `false` - if `true`, do not scope cookies by path. The default uses RFC-compliant path scoping. **Note**: may not be supported by the CookieStore `fetchCookies` function (the default MemoryCookieStore supports it).
 
 The `.lastAccessed` property of the returned cookies will have been updated.
 
@@ -309,6 +310,8 @@ If no cookies are found, the callback MUST be passed an empty array.
 
 The resulting list will be checked for applicability to the current request according to the RFC (domain-match, path-match, http-only-flag, secure-flag, expiry, etc.), so it's OK to use an optimistic search algorithm when implementing this method.  However, the search algorithm used SHOULD try to find cookies that `domainMatch()` the domain and `pathMatch()` the path in order to limit the amount of checking that needs to be done.
 
+As of version 0.9.12, the `allPaths` option to `cookiejar.getCookies()` above will cause the path here to be `null`.  If the path is `null`, path-matching MUST NOT be performed (i.e. domain-matching only).
+
 store.putCookie(cookie, cb(err))
 --------------------------------
 

package/lib/cookie.js

@@ -19,13 +19,14 @@
  * IN THE SOFTWARE.
  */
 
+/*jshint regexp:false */
 var net = require('net');
 var urlParse = require('url').parse;
 var pubsuffix = require('./pubsuffix');
 
 var punycode;
 try {
-  punycode = require('punycode')
+  punycode = require('punycode');
 } catch(e) {
   console.warn("cookie: can't load punycode; won't use punycode for domain normalization");
 }
@@ -188,13 +189,13 @@ function parseDate(str,strict) {
   }
 
   return date;
-};
+}
 
 function formatDate(date) {
-  var d = date.getUTCDate(); d = d > 10 ? d : '0'+d;
-  var h = date.getUTCHours(); h = h > 10 ? h : '0'+h;
-  var m = date.getUTCMinutes(); m = m > 10 ? m : '0'+m;
-  var s = date.getUTCSeconds(); s = s > 10 ? s : '0'+s;
+  var d = date.getUTCDate(); d = d >= 10 ? d : '0'+d;
+  var h = date.getUTCHours(); h = h >= 10 ? h : '0'+h;
+  var m = date.getUTCMinutes(); m = m >= 10 ? m : '0'+m;
+  var s = date.getUTCSeconds(); s = s >= 10 ? s : '0'+s;
   return NUM_TO_DAY[date.getUTCDay()] + ', ' +
     d+' '+ NUM_TO_MONTH[date.getUTCMonth()] +' '+ date.getUTCFullYear() +' '+
     h+':'+m+':'+s+' GMT';
@@ -214,6 +215,7 @@ function canonicalDomain(str) {
 
 // S5.1.3 Domain Matching
 function domainMatch(str, domStr, canonicalize) {
+  if (str == null || domStr == null) return null;
   if (canonicalize !== false) {
     str = canonicalDomain(str);
     domStr = canonicalDomain(domStr);
@@ -266,7 +268,7 @@ function defaultPath(path) {
 
   var rightSlash = path.lastIndexOf("/");
   if (rightSlash === 0) return "/";
-  
+
   // "4. Output the characters of the uri-path from the first character up to,
   // but not including, the right-most %x2F ("/")."
   return path.slice(0, rightSlash);
@@ -300,7 +302,7 @@ function pathMatch(reqPath,cookiePath) {
 
 function parse(str, strict) {
   str = str.trim();
-  
+
   // S4.1.1 Trailing semi-colons are not part of the specification.
   // If we are not in strict mode we remove the trailing semi-colons.
   var semiColonCheck = TRAILING_SEMICOLON.exec(str);
@@ -333,7 +335,7 @@ function parse(str, strict) {
   // steps."
   if (unparsed.length === 0) return c;
 
-  /* 
+  /*
    * S5.2 says that when looping over the items "[p]rocess the attribute-name
    * and attribute-value according to the requirements in the following
    * subsections" for every item.  Plus, for many of the individual attributes
@@ -347,30 +349,38 @@ function parse(str, strict) {
 
     if (strict && !EXTENSION_AV.test(av)) return;
 
-    var av_parts = av.split('=',2);
-    var av_key = av_parts[0].trim().toLowerCase();
-    var av_value = av_parts[1];
+    var av_sep = av.indexOf('=');
+    var av_key, av_value;
+    if (av_sep === -1) {
+      av_key = av;
+      av_value = null;
+    } else {
+      av_key = av.substr(0,av_sep);
+      av_value = av.substr(av_sep+1);
+    }
+
+    av_key = av_key.trim().toLowerCase();
     if (av_value) av_value = av_value.trim();
 
     switch(av_key) {
     case 'expires': // S5.2.1
-      if (!av_value) { if(strict){return}else{break} }
+      if (!av_value) { if(strict){return}else{break;} }
       var exp = parseDate(av_value,strict);
       // "If the attribute-value failed to parse as a cookie date, ignore the
       // cookie-av."
-      if (exp == null) { if(strict){return}else{break} }
+      if (exp == null) { if(strict){return}else{break;} }
       c.expires = exp;
       // over and underflow not realistically a concern: V8's getTime() seems to
       // store something larger than a 32-bit time_t (even with 32-bit node)
       break;
 
     case 'max-age': // S5.2.2
-      if (!av_value) { if(strict){return}else{break} }
+      if (!av_value) { if(strict){return}else{break;} }
       // "If the first character of the attribute-value is not a DIGIT or a "-"
       // character ...[or]... If the remainder of attribute-value contains a
       // non-DIGIT character, ignore the cookie-av."
-      if (!/^-?[0-9]+$/.test(av_value)) { if(strict){return}else{break} }
-      var delta = parseInt(av_value);
+      if (!/^-?[0-9]+$/.test(av_value)) { if(strict){return}else{break;} }
+      var delta = parseInt(av_value,10);
       if (strict && delta <= 0) return; // S4.1.1
       // "If delta-seconds is less than or equal to zero (0), let expiry-time
       // be the earliest representable date and time."
@@ -380,11 +390,11 @@ function parse(str, strict) {
     case 'domain': // S5.2.3
       // "If the attribute-value is empty, the behavior is undefined.  However,
       // the user agent SHOULD ignore the cookie-av entirely."
-      if (!av_value) { if(strict){return}else{break} }
+      if (!av_value) { if(strict){return}else{break;} }
       // S5.2.3 "Let cookie-domain be the attribute-value without the leading %x2E
       // (".") character."
       var domain = av_value.trim().replace(/^\./,'');
-      if (!domain) { if(strict){return}else{break} } // see "is empty" above
+      if (!domain) { if(strict){return}else{break;} } // see "is empty" above
       // "Convert the cookie-domain to lower case."
       c.domain = domain.toLowerCase();
       break;
@@ -400,7 +410,7 @@ function parse(str, strict) {
        * We'll represent the default-path as null since it depends on the
        * context of the parsing.
        */
-      if (!av_value || av_value.substr(0,1) != "/") { if(strict){return}else{break} }
+      if (!av_value || av_value.substr(0,1) != "/") { if(strict){return}else{break;} }
       c.path = av_value;
       break;
 
@@ -434,8 +444,9 @@ function parse(str, strict) {
 function fromJSON(str) {
   if (!str) return null;
 
+  var obj;
   try {
-    var obj = JSON.parse(str);
+    obj = JSON.parse(str);
   } catch (e) {
     return null;
   }
@@ -464,7 +475,7 @@ function fromJSON(str) {
 /* Section 5.4 part 2:
  * "*  Cookies with longer paths are listed before cookies with
  *     shorter paths.
- * 
+ *
  *  *  Among cookies that have equal-length path fields, cookies with
  *     earlier creation-times are listed before cookies with later
  *     creation-times."
@@ -473,10 +484,10 @@ function fromJSON(str) {
 function cookieCompare(a,b) {
   // descending for length: b CMP a
   var deltaLen = (b.path ? b.path.length : 0) - (a.path ? a.path.length : 0);
-  if (deltaLen != 0) return deltaLen;
+  if (deltaLen !== 0) return deltaLen;
   // ascending for time: a CMP b
-  return (a.creation ? a.creation.getTime() : MAX_TIME)
-       - (b.creation ? b.creation.getTime() : MAX_TIME);
+  return (a.creation ? a.creation.getTime() : MAX_TIME) -
+         (b.creation ? b.creation.getTime() : MAX_TIME);
 }
 
 // Gives the permutation of all possible domainMatch()es of a given domain. The
@@ -554,11 +565,11 @@ var numCookieProperties = cookieProperties.length;
 
 Cookie.prototype.inspect = function inspect() {
   var now = Date.now();
-  return 'Cookie="'+this.toString()
-    + '; hostOnly='+(this.hostOnly != null ? this.hostOnly : '?')
-    + '; aAge='+(this.lastAccessed ? (now-this.lastAccessed.getTime())+'ms' : '?')
-    + '; cAge='+(this.creation ? (now-this.creation.getTime())+'ms' : '?')
-    + '"';
+  return 'Cookie="'+this.toString() +
+    '; hostOnly='+(this.hostOnly != null ? this.hostOnly : '?') +
+    '; aAge='+(this.lastAccessed ? (now-this.lastAccessed.getTime())+'ms' : '?') +
+    '; cAge='+(this.creation ? (now-this.creation.getTime())+'ms' : '?') +
+    '"';
 };
 
 Cookie.prototype.validate = function validate() {
@@ -691,7 +702,7 @@ Cookie.prototype.isPersistent = function isPersistent() {
 };
 
 // Mostly S5.1.2 and S5.2.3:
-Cookie.prototype.cdomain = 
+Cookie.prototype.cdomain =
 Cookie.prototype.canonicalizedDomain = function canonicalizedDomain() {
   if (this.domain == null) return null;
   return canonicalDomain(this.domain);
@@ -711,6 +722,7 @@ CookieJar.prototype.store = null;
 CookieJar.prototype.rejectPublicSuffixes = true;
 
 CookieJar.prototype.setCookie = function setCookie(cookie, url, options, cb) {
+  var err;
   var context = (url instanceof Object) ? url : urlParse(url);
   if (options instanceof Function) {
     cb = options;
@@ -723,7 +735,7 @@ CookieJar.prototype.setCookie = function setCookie(cookie, url, options, cb) {
   if (!(cookie instanceof Cookie))
     cookie = Cookie.parse(cookie, options.strict === true);
   if (!cookie) {
-    var err = new Error("Cookie failed to parse");
+    err = new Error("Cookie failed to parse");
     return cb(options.ignoreError ? null : err);
   }
 
@@ -738,7 +750,7 @@ CookieJar.prototype.setCookie = function setCookie(cookie, url, options, cb) {
   if (this.rejectPublicSuffixes && cookie.domain) {
     var suffix = pubsuffix.getPublicSuffix(cookie.cdomain());
     if (suffix == null) { // e.g. "com"
-      var err = new Error("Cookie has domain set to a public suffix");
+      err = new Error("Cookie has domain set to a public suffix");
       return cb(options.ignoreError ? null : err);
     }
   }
@@ -746,7 +758,7 @@ CookieJar.prototype.setCookie = function setCookie(cookie, url, options, cb) {
   // S5.3 step 6:
   if (cookie.domain) {
     if (!domainMatch(host, cookie.cdomain(), false)) {
-      var err = new Error("Cookie not in this host's domain. Cookie:"+cookie.cdomain()+" Request:"+host);
+      err = new Error("Cookie not in this host's domain. Cookie:"+cookie.cdomain()+" Request:"+host);
       return cb(options.ignoreError ? null : err);
     }
 
@@ -773,7 +785,7 @@ CookieJar.prototype.setCookie = function setCookie(cookie, url, options, cb) {
 
   // S5.3 step 10
   if (options.http === false && cookie.httpOnly) {
-    var err = new Error("Cookie is HttpOnly and this isn't an HTTP API");
+    err = new Error("Cookie is HttpOnly and this isn't an HTTP API");
     return cb(options.ignoreError ? null : err);
   }
 
@@ -797,7 +809,7 @@ CookieJar.prototype.setCookie = function setCookie(cookie, url, options, cb) {
       // S5.3 step 11 - "If the cookie store contains a cookie with the same name,
       // domain, and path as the newly created cookie:"
       if (options.http === false && oldCookie.httpOnly) { // step 11.2
-        var err = new Error("old Cookie is HttpOnly and this isn't an HTTP API");
+        err = new Error("old Cookie is HttpOnly and this isn't an HTTP API");
         return cb(options.ignoreError ? null : err);
       }
       cookie.creation = oldCookie.creation; // step 11.3
@@ -835,6 +847,7 @@ CookieJar.prototype.getCookies = function getCookies(url, options, cb) {
 
   var now = options.now || Date.now();
   var expireCheck = options.expire !== false;
+  var allPaths = !!options.allPaths;
   var store = this.store;
 
   function matchingCookie(c) {
@@ -851,7 +864,7 @@ CookieJar.prototype.getCookies = function getCookies(url, options, cb) {
     }
 
     // "The request-uri's path path-matches the cookie's path."
-    if (!pathMatch(path, c.path))
+    if (!allPaths && !pathMatch(path, c.path))
       return false;
 
     // "If the cookie's secure-only-flag is true, then the request-uri's
@@ -861,7 +874,7 @@ CookieJar.prototype.getCookies = function getCookies(url, options, cb) {
 
     // "If the cookie's http-only-flag is true, then exclude the cookie if the
     // cookie-string is being generated for a "non-HTTP" API"
-    if (http == false && c.httpOnly)
+    if (c.httpOnly && !http)
       return false;
 
     // deferred from S5.3
@@ -874,7 +887,7 @@ CookieJar.prototype.getCookies = function getCookies(url, options, cb) {
     return true;
   }
 
-  store.findCookies(host, path, function(err,cookies) {
+  store.findCookies(host, allPaths ? null : path, function(err,cookies) {
     if (err) return cb(err);
 
     cookies = cookies.filter(matchingCookie);

package/lib/memstore.js

@@ -22,24 +22,50 @@ MemoryCookieStore.prototype.findCookie = function findCookie(domain, path, key,
 
 MemoryCookieStore.prototype.findCookies = function findCookies(domain, path, cb) {
   var results = [];
-  if (!domain || !path) return cb(null,[]);
+  if (!domain) return cb(null,[]);
 
-  var domains = permuteDomain(domain)||[domain], dlen = domains.length;
-  var paths = permutePath(path), plen = paths.length;
+  var pathMatcher;
+  if (!path) {
+    // null or '/' means "all paths"
+    pathMatcher = function matchAll(domainIndex) {
+      for (var curPath in domainIndex) {
+        var pathIndex = domainIndex[curPath];
+        for (var key in pathIndex) {
+          results.push(pathIndex[key]);
+        }
+      }
+    };
 
-  for (var i=0; i<dlen; i++) {
-    var curDomain = domains[i];
-    var domainIndex = this.idx[curDomain];
-    if (!domainIndex) continue;
-    for (var j=0; j<plen; j++) {
-      var curPath = paths[j];
-      var pathIndex = domainIndex[curPath];
-      if (!pathIndex) continue;
+  } else if (path === '/') {
+    pathMatcher = function matchSlash(domainIndex) {
+      var pathIndex = domainIndex['/'];
+      if (!pathIndex) return;
       for (var key in pathIndex) {
         results.push(pathIndex[key]);
       }
-    }
+    };
+
+  } else {
+    var paths = permutePath(path) || [path];
+    pathMatcher = function matchRFC(domainIndex) {
+      paths.forEach(function(curPath) {
+        var pathIndex = domainIndex[curPath];
+        if (!pathIndex) return;
+        for (var key in pathIndex) {
+          results.push(pathIndex[key]);
+        }
+      });
+    };
   }
+
+  var domains = permuteDomain(domain) || [domain];
+  var idx = this.idx;
+  domains.forEach(function(curDomain) {
+    var domainIndex = idx[curDomain];
+    if (!domainIndex) return;
+    pathMatcher(domainIndex);
+  });
+
   cb(null,results);
 };
 

package/package.json

@@ -2,8 +2,8 @@
   "author": "Jeremy Stashewsky <jeremy@goinstant.com> (https://github.com/stash)",
   "name": "tough-cookie",
   "description": "RFC6265 Cookies and Cookie Jar for node.js",
-  "keywords": "HTTP cookie cookies set-cookie cookiejar jar RFC6265 RFC2965",
-  "version": "0.9.11",
+  "keywords":["HTTP","cookie","cookies","set-cookie","cookiejar","jar","RFC6265","RFC2965"],
+  "version": "0.9.15",
   "homepage": "https://github.com/goinstant/node-cookie",
   "repository": {
     "type": "git",

package/test.js

@@ -35,11 +35,11 @@ function dateVows(table) {
     var expect = table[date];
     theVows[date] = function() {
       var got = tough.parseDate(date) ? 'valid' : 'invalid';
-      assert.equal(got, expect ? 'valid' : 'invalid')
+      assert.equal(got, expect ? 'valid' : 'invalid');
     };
   });
-  return { "date parsing": theVows }
-};
+  return { "date parsing": theVows };
+}
 
 function matchVows(func,table) {
   var theVows = {};
@@ -71,12 +71,14 @@ function defaultPathVows(table) {
 var atNow = Date.now();
 function at(offset) { return {now: new Date(atNow+offset)} }
 
-vows.describe('Cookie Jar').addBatch({
+vows.describe('Cookie Jar')
+.addBatch({
   "all defined": function() {
     assert.ok(Cookie);
     assert.ok(CookieJar);
   },
-}).addBatch(
+})
+.addBatch(
   dateVows({
     "Wed, 09 Jun 2021 10:18:14 GMT": true,
     "Wed, 09 Jun 2021 22:18:14 GMT": true,
@@ -93,8 +95,11 @@ vows.describe('Cookie Jar').addBatch({
     '01 Jan 1601 00:00:00 GMT': true,
     '10 Feb 81 13:00:00 GMT': true, // implicit year
     'Thu, 01 Jan 1970 00:00:010 GMT': true, // strange time, non-strict OK
+    'Thu, 17-Apr-2014 02:12:29 GMT': true, // dashes
+    'Thu, 17-Apr-2014 02:12:29 UTC': true, // dashes and UTC
   })
-).addBatch({
+)
+.addBatch({
   "strict date parse of Thu, 01 Jan 1970 00:00:010 GMT": {
     topic: function() {
       return tough.parseDate('Thu, 01 Jan 1970 00:00:010 GMT', true) ? true : false;
@@ -103,7 +108,8 @@ vows.describe('Cookie Jar').addBatch({
       assert.equal(date,false);
     },
   }
-}).addBatch({
+})
+.addBatch({
   "formatting": {
     "a simple cookie": {
       topic: function() {
@@ -208,8 +214,26 @@ vows.describe('Cookie Jar').addBatch({
         assert.equal(c.toString(), 'a=b; Path=/should-stringify');
       },
     },
+    "minutes are '10'": {
+      topic: function() {
+        var c = new Cookie();
+        c.key = 'a';
+        c.value = 'b';
+        c.expires = new Date(1284113410000);
+        return c;
+      },
+      "validates": function(c) {
+        assert.ok(c.validate());
+      },
+      "to string": function(c) {
+        var str = c.toString();
+        assert.notEqual(str, 'a=b; Expires=Fri, 010 Sep 2010 010:010:010 GMT');
+        assert.equal(str, 'a=b; Expires=Fri, 10 Sep 2010 10:10:10 GMT');
+      },
+    }
   }
-}).addBatch({
+})
+.addBatch({
   "TTL with max-age": function() {
     var c = new Cookie();
     c.maxAge = 123;
@@ -403,11 +427,11 @@ vows.describe('Cookie Jar').addBatch({
           "c=d;;;;"
         ];
       },
-      "strict": function (t) { 
-        assert.ok(!Cookie.parse(t[0], true)); 
+      "strict": function (t) {
+        assert.ok(!Cookie.parse(t[0], true));
         assert.ok(!Cookie.parse(t[1], true));
       },
-      "non-strict": function (t) { 
+      "non-strict": function (t) {
         var c1 = Cookie.parse(t[0]);
         var c2 = Cookie.parse(t[1]);
         assert.ok(c1);
@@ -467,9 +491,26 @@ vows.describe('Cookie Jar').addBatch({
       },
       "secure": function(c) { assert.ok(c.secure) },
       "httponly": function(c) { assert.ok(c.httpOnly) },
+    },
+    "lots of equal signs": {
+      topic: function() {
+        return Cookie.parse("queryPref=b=c&d=e; Path=/f=g; Expires=Thu, 17 Apr 2014 02:12:29 GMT; HttpOnly");
+      },
+      "parsed": function(c) { assert.ok(c) },
+      "key": function(c) { assert.equal(c.key, 'queryPref') },
+      "value": function(c) { assert.equal(c.value, 'b=c&d=e') },
+      "path": function(c) {
+        assert.equal(c.path, '/f=g');
+      },
+      "expires": function(c) {
+        assert.notEqual(c.expires, Infinity);
+        assert.equal(c.expires.getTime(), 1397700749000);
+      },
+      "httponly": function(c) { assert.ok(c.httpOnly) },
     }
   }
-}).addBatch({
+})
+.addBatch({
   "domain normalization": {
     "simple": function() {
       var c = new Cookie();
@@ -497,7 +538,8 @@ vows.describe('Cookie Jar').addBatch({
       assert.equal(c.canonicalizedDomain(), "xn--jxalpdlp.xn--jxalpdlp");
     }
   }
-}).addBatch({
+})
+.addBatch({
   "Domain Match":matchVows(tough.domainMatch, [
     // str,          dom,          expect
     ["example.com", "example.com", true],
@@ -510,8 +552,13 @@ vows.describe('Cookie Jar').addBatch({
     ["www.subdom.example.com", "subdom.example.com", true],
     ["example.com", "example.com.", false], // RFC6265 S4.1.2.3
     ["192.168.0.1", "168.0.1", false], // S5.1.3 "The string is a host name"
+    [null, "example.com", null],
+    ["example.com", null, null],
+    [null, null, null],
+    [undefined, undefined, null],
   ])
-}).addBatch({
+})
+.addBatch({
   "default-path": defaultPathVows([
     [null,"/"],
     ["/","/"],
@@ -519,7 +566,8 @@ vows.describe('Cookie Jar').addBatch({
     ["/dir/file","/dir"],
     ["noslash","/"],
   ])
-}).addBatch({
+})
+.addBatch({
   "Path-Match": matchVows(tough.pathMatch, [
     // request, cookie, match
     ["/","/",true],
@@ -530,7 +578,8 @@ vows.describe('Cookie Jar').addBatch({
     ["/dir/file","/dir",true],
     ["/directory","/dir",false],
   ])
-}).addBatch({
+})
+.addBatch({
   "Cookie Sorting": {
     topic: function() {
       var cookies = [];
@@ -561,7 +610,8 @@ vows.describe('Cookie Jar').addBatch({
       assert.deepEqual(names, ['e','f','c','d','a','b']);
     },
   }
-}).addBatch({
+})
+.addBatch({
   "CookieJar": {
     "Setting a basic cookie": {
       topic: function() {
@@ -834,7 +884,7 @@ vows.describe('Cookie Jar').addBatch({
   },
   "CookieJar setCookie errors": {
     "public-suffix domain": {
-      topic: function(cj) {
+      topic: function() {
         var cj = new CookieJar();
         cj.setCookie('i=9; Domain=kyoto.jp; Path=/','kyoto.jp',this.callback);
       },
@@ -845,7 +895,7 @@ vows.describe('Cookie Jar').addBatch({
       },
     },
     "wrong domain": {
-      topic: function(cj) {
+      topic: function() {
         var cj = new CookieJar();
         cj.setCookie('j=10; Domain=google.com; Path=/','google.ca',this.callback);
       },
@@ -856,7 +906,7 @@ vows.describe('Cookie Jar').addBatch({
       },
     },
     "old cookie is HttpOnly": {
-      topic: function(cj) {
+      topic: function() {
         var cb = this.callback;
         var next = function (err,c) {
           return cb(err,cj);
@@ -889,7 +939,8 @@ vows.describe('Cookie Jar').addBatch({
       },
     },
   },
-}).addBatch({
+})
+.addBatch({
   "JSON": {
     "serialization": {
       topic: function() {
@@ -900,7 +951,7 @@ vows.describe('Cookie Jar').addBatch({
         assert.equal(typeof str, "string");
       },
       "date is in ISO format": function(str) {
-        assert.match(str, /"expires":"2038-01-19T03:14:07.000Z"/, 'expires is in ISO format');
+        assert.match(str, /"expires":"2038-01-19T03:14:07\.000Z"/, 'expires is in ISO format');
       },
     },
     "deserialization": {
@@ -1012,7 +1063,8 @@ vows.describe('Cookie Jar').addBatch({
       },
     },
   }
-}).addBatch({
+})
+.addBatch({
   "permuteDomain": {
     "base case": {
       topic: tough.permuteDomain.bind(null,'example.com'),
@@ -1074,7 +1126,8 @@ vows.describe('Cookie Jar').addBatch({
       },
     },
   }
-}).addBatch({
+})
+.addBatch({
   "Issue 1": {
     topic: function() {
       var cj = new CookieJar();
@@ -1104,7 +1157,8 @@ vows.describe('Cookie Jar').addBatch({
       },
     }
   }
-}).addBatch({
+})
+.addBatch({
   "expiry option": {
     topic: function() {
       var cb = this.callback;
@@ -1134,13 +1188,14 @@ vows.describe('Cookie Jar').addBatch({
       },
     }
   }
-}).addBatch({
+})
+.addBatch({
   "trailing semi-colon set into cj": {
     topic: function () {
       var cb = this.callback;
       var cj = new CookieJar();
       var ex = 'http://www.example.com';
-      tasks = []
+      var tasks = [];
       tasks.push(function(next) {
         cj.setCookie('broken_path=testme; path=/;',ex,at(-1),next);
       });
@@ -1182,10 +1237,11 @@ vows.describe('Cookie Jar').addBatch({
         assert.equal(t.cookies[1].key, "b");
         assert.equal(t.cookies[1].value, "2");
         assert.equal(t.cookies[1].path, "/");
-      },    
+      },
     },
   }
-}).addBatch({
+})
+.addBatch({
   "Constructor":{
     topic: function () {
       return new Cookie({
@@ -1210,4 +1266,75 @@ vows.describe('Cookie Jar').addBatch({
       assert.equal(c.httpOnly, false);
     }
   }
-}).export(module);
+})
+.addBatch({
+  "allPaths option": {
+    topic: function() {
+      var cj = new CookieJar();
+      var tasks = [];
+      tasks.push(cj.setCookie.bind(cj, 'nopath_dom=qq; Path=/; Domain=example.com', 'http://example.com', {}));
+      tasks.push(cj.setCookie.bind(cj, 'path_dom=qq; Path=/foo; Domain=example.com', 'http://example.com', {}));
+      tasks.push(cj.setCookie.bind(cj, 'nopath_host=qq; Path=/', 'http://www.example.com', {}));
+      tasks.push(cj.setCookie.bind(cj, 'path_host=qq; Path=/foo', 'http://www.example.com', {}));
+      tasks.push(cj.setCookie.bind(cj, 'other=qq; Path=/', 'http://other.example.com/', {}));
+      tasks.push(cj.setCookie.bind(cj, 'other2=qq; Path=/foo', 'http://other.example.com/foo', {}));
+      var cb = this.callback;
+      async.parallel(tasks, function(err,results) {
+        cb(err, {cj:cj, cookies: results});
+      });
+    },
+    "all set": function(t) {
+      assert.equal(t.cookies.length, 6);
+      assert.ok(t.cookies.every(function(c) { return !!c }));
+    },
+    "getting without allPaths": {
+      topic: function(t) {
+        var cb = this.callback;
+        var cj = t.cj;
+        cj.getCookies('http://www.example.com/', {}, function(err,cookies) {
+          cb(err, {cj:cj, cookies:cookies});
+        });
+      },
+      "found just two cookies": function(t) {
+        assert.equal(t.cookies.length, 2);
+      },
+      "all are path=/": function(t) {
+        assert.ok(t.cookies.every(function(c) { return c.path === '/' }));
+      },
+      "no 'other' cookies": function(t) {
+        assert.ok(!t.cookies.some(function(c) { return (/^other/).test(c.name) }));
+      },
+    },
+    "getting without allPaths for /foo": {
+      topic: function(t) {
+        var cb = this.callback;
+        var cj = t.cj;
+        cj.getCookies('http://www.example.com/foo', {}, function(err,cookies) {
+          cb(err, {cj:cj, cookies:cookies});
+        });
+      },
+      "found four cookies": function(t) {
+        assert.equal(t.cookies.length, 4);
+      },
+      "no 'other' cookies": function(t) {
+        assert.ok(!t.cookies.some(function(c) { return (/^other/).test(c.name) }));
+      },
+    },
+    "getting with allPaths:true": {
+      topic: function(t) {
+        var cb = this.callback;
+        var cj = t.cj;
+        cj.getCookies('http://www.example.com/', {allPaths:true}, function(err,cookies) {
+          cb(err, {cj:cj, cookies:cookies});
+        });
+      },
+      "found four cookies": function(t) {
+        assert.equal(t.cookies.length, 4);
+      },
+      "no 'other' cookies": function(t) {
+        assert.ok(!t.cookies.some(function(c) { return (/^other/).test(c.name) }));
+      },
+    },
+  }
+})
+.export(module);