tough-cookie 2.0.0 → 2.2.2

package/LICENSE

@@ -17,58 +17,11 @@ The following exceptions apply:
 
 ===
 
-`pubSufTest()` of generate-pubsuffix.js is in the public domain.
-
-  // Any copyright is dedicated to the Public Domain.
-  // http://creativecommons.org/publicdomain/zero/1.0/
-
-===
-
-`public-suffix.txt` was obtained from
-<https://mxr.mozilla.org/mozilla-central/source/netwerk/dns/effective_tld_names.dat?raw=1>
-via <http://publicsuffix.org>.
-
-That file contains the usual Mozilla triple-license, for which this project uses it
-under the terms of the MPL 1.1:
-
-    // ***** BEGIN LICENSE BLOCK *****
-    // Version: MPL 1.1/GPL 2.0/LGPL 2.1
-    //
-    // The contents of this file are subject to the Mozilla Public License Version
-    // 1.1 (the "License"); you may not use this file except in compliance with
-    // the License. You may obtain a copy of the License at
-    // http://www.mozilla.org/MPL/
-    //
-    // Software distributed under the License is distributed on an "AS IS" basis,
-    // WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
-    // for the specific language governing rights and limitations under the
-    // License.
-    //
-    // The Original Code is the Public Suffix List.
-    //
-    // The Initial Developer of the Original Code is
-    // Jo Hermans <jo.hermans@gmail.com>.
-    // Portions created by the Initial Developer are Copyright (C) 2007
-    // the Initial Developer. All Rights Reserved.
-    //
-    // Contributor(s):
-    //   Ruben Arakelyan <ruben@rubenarakelyan.com>
-    //   Gervase Markham <gerv@gerv.net>
-    //   Pamela Greene <pamg.bugs@gmail.com>
-    //   David Triendl <david@triendl.name>
-    //   Jothan Frakes <jothan@gmail.com>
-    //   The kind representatives of many TLD registries
-    //
-    // Alternatively, the contents of this file may be used under the terms of
-    // either the GNU General Public License Version 2 or later (the "GPL"), or
-    // the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
-    // in which case the provisions of the GPL or the LGPL are applicable instead
-    // of those above. If you wish to allow use of your version of this file only
-    // under the terms of either the GPL or the LGPL, and not to allow others to
-    // use your version of this file under the terms of the MPL, indicate your
-    // decision by deleting the provisions above and replace them with the notice
-    // and other provisions required by the GPL or the LGPL. If you do not delete
-    // the provisions above, a recipient may use your version of this file under
-    // the terms of any one of the MPL, the GPL or the LGPL.
-    //
-    // ***** END LICENSE BLOCK *****
+`public_suffix_list.dat` was obtained from
+<https://publicsuffix.org/list/public_suffix_list.dat> via
+<http://publicsuffix.org>. The license for this file is MPL/2.0.  The header of
+that file reads as follows:
+
+  // This Source Code Form is subject to the terms of the Mozilla Public
+  // License, v. 2.0. If a copy of the MPL was not distributed with this
+  // file, You can obtain one at http://mozilla.org/MPL/2.0/.

package/README.md

@@ -68,9 +68,9 @@ Answers "does the request-path path-match a given cookie-path?" as per RFC6265 S
 
 This is essentially a prefix-match where `cookiePath` is a prefix of `reqPath`.
 
-### `parse(header)`
+### `parse(cookieString[, options])`
 
-alias for `Cookie.parse(header)`
+alias for `Cookie.parse(cookieString[, options])`
 
 ### `fromJSON(string)`
 
@@ -112,15 +112,21 @@ Generates a list of all possible paths that `pathMatch()` the parameter.  May be
 
 Exported via `tough.Cookie`.
 
-### `Cookie.parse(header)`
+### `Cookie.parse(cookieString[, options])`
 
 Parses a single Cookie or Set-Cookie HTTP header into a `Cookie` object.  Returns `undefined` if the string can't be parsed.
 
+The options parameter is not required and currently has only one property:
+
+  * _loose_ - boolean - if `true` enable parsing of key-less cookies like `=abc` and `=`, which are not RFC-compliant.
+
+If options is not an object, it is ignored, which means you can use `Array#map` with it.
+
 Here's how to process the Set-Cookie header(s) on a node HTTP/HTTPS response:
 
 ``` javascript
 if (res.headers['set-cookie'] instanceof Array)
-  cookies = res.headers['set-cookie'].map(function (c) { return (Cookie.parse(c)); });
+  cookies = res.headers['set-cookie'].map(Cookie.parse);
 else
   cookies = [Cookie.parse(res.headers['set-cookie'])];
 ```
@@ -231,15 +237,15 @@ if (cookie.validate() === true) {
 
 Exported via `tough.CookieJar`.
 
-### `CookieJar([store],[rejectPublicSuffixes])`
+### `CookieJar([store],[options])`
 
 Simply use `new CookieJar()`.  If you'd like to use a custom store, pass that to the constructor otherwise a `MemoryCookieStore` will be created and used.
 
-### Properties
-
-CookieJar object properties:
+The `options` object can be omitted and can have the following properties:
 
-  * _rejectPublicSuffixes_ - boolean - reject cookies with domains like "com" and "co.uk" (default: `true`)
+  * _rejectPublicSuffixes_ - boolean - default `true` - reject cookies with domains like "com" and "co.uk"
+  * _looseMode_ - boolean - default `false` - accept malformed cookies like `bar` and `=bar`, which have an implied empty name.
+    This is not in the standard, but is used sometimes on the web and is accepted by (most) browsers.
 
 Since eventually this module would like to support database/remote/etc. CookieJars, continuation passing style is used for CookieJar methods.
 
@@ -450,7 +456,7 @@ A just-in-memory CookieJar synchronous store implementation, used by default. De
 
 # Copyright and License
 
-(tl;dr: BSD-3-Clause with some MPL/1.1)
+(tl;dr: BSD-3-Clause with some MPL/2.0)
 
 ```text
  Copyright (c) 2015, Salesforce.com, Inc.
@@ -483,4 +489,4 @@ A just-in-memory CookieJar synchronous store implementation, used by default. De
  POSSIBILITY OF SUCH DAMAGE.
 ```
 
-Portions may be licensed under different licenses (in particular public-suffix.txt is MPL/1.1); please read the LICENSE file for full details.
+Portions may be licensed under different licenses (in particular `public_suffix_list.dat` is MPL/2.0); please read that file and the LICENSE file for full details.

package/lib/cookie.js

@@ -49,14 +49,20 @@ var DATE_DELIM = /[\x09\x20-\x2F\x3B-\x40\x5B-\x60\x7B-\x7E]/;
 // From RFC6265 S4.1.1
 // note that it excludes \x3B ";"
 var COOKIE_OCTET  = /[\x21\x23-\x2B\x2D-\x3A\x3C-\x5B\x5D-\x7E]/;
-var COOKIE_OCTETS = new RegExp('^'+COOKIE_OCTET.source+'$');
+var COOKIE_OCTETS = new RegExp('^'+COOKIE_OCTET.source+'+$');
+
+var CONTROL_CHARS = /[\x00-\x1F]/;
 
 // Double quotes are part of the value (see: S4.1.1).
 // '\r', '\n' and '\0' should be treated as a terminator in the "relaxed" mode
 // (see: https://github.com/ChromiumWebApps/chromium/blob/b3d3b4da8bb94c1b2e061600df106d590fda3620/net/cookies/parsed_cookie.cc#L60)
 // '=' and ';' are attribute/values separators
 // (see: https://github.com/ChromiumWebApps/chromium/blob/b3d3b4da8bb94c1b2e061600df106d590fda3620/net/cookies/parsed_cookie.cc#L64)
-var COOKIE_PAIR = /^([^=;]+)\s*=\s*(("?)[^\n\r\0]*\3)/;
+var COOKIE_PAIR = /^(([^=;]+))\s*=\s*([^\n\r\0]*)/;
+
+// Used to parse non-RFC-compliant cookies like '=abc' when given the `loose`
+// option in Cookie.parse:
+var LOOSE_COOKIE_PAIR = /^((?:=)?([^=;]*)\s*=\s*)?([^\n\r\0]*)/;
 
 // RFC6265 S4.1.1 defines path value as 'any CHAR except CTLs or ";"'
 // Note ';' is \x3B
@@ -315,7 +321,10 @@ function defaultPath(path) {
 }
 
 
-function parse(str) {
+function parse(str, options) {
+  if (!options || typeof options !== 'object') {
+    options = {};
+  }
   str = str.trim();
 
   // S4.1.1 Trailing semi-colons are not part of the specification.
@@ -326,7 +335,8 @@ function parse(str) {
 
   // We use a regex to parse the "name-value-pair" part of S5.2
   var firstSemi = str.indexOf(';'); // S5.2 step 1
-  var result = COOKIE_PAIR.exec(firstSemi === -1 ? str : str.substr(0,firstSemi));
+  var pairRe = options.loose ? LOOSE_COOKIE_PAIR : COOKIE_PAIR;
+  var result = pairRe.exec(firstSemi === -1 ? str : str.substr(0,firstSemi));
 
   // Rx satisfies the "the name string is empty" and "lacks a %x3D ("=")"
   // constraints as well as trimming any whitespace.
@@ -335,8 +345,15 @@ function parse(str) {
   }
 
   var c = new Cookie();
-  c.key = result[1].trim();
-  c.value = result[2].trim();
+  if (result[1]) {
+    c.key = result[2].trim();
+  } else {
+    c.key = '';
+  }
+  c.value = result[3].trim();
+  if (CONTROL_CHARS.test(c.key) || CONTROL_CHARS.test(c.value)) {
+    return;
+  }
 
   if (firstSemi === -1) {
     return c;
@@ -586,15 +603,15 @@ function getCookieContext(url) {
   return urlParse(url);
 }
 
-function Cookie(opts) {
-  opts = opts || {};
+function Cookie(options) {
+  options = options || {};
 
-  Object.keys(opts).forEach(function(prop) {
+  Object.keys(options).forEach(function(prop) {
     if (Cookie.prototype.hasOwnProperty(prop) &&
-        Cookie.prototype[prop] !== opts[prop] &&
+        Cookie.prototype[prop] !== options[prop] &&
         prop.substr(0,1) !== '_')
     {
-      this[prop] = opts[prop];
+      this[prop] = options[prop];
     }
   }, this);
 
@@ -745,6 +762,9 @@ Cookie.prototype.cookieString = function cookieString() {
   if (val == null) {
     val = '';
   }
+  if (this.key === '') {
+    return val;
+  }
   return this.key+'='+val;
 };
 
@@ -858,9 +878,17 @@ Cookie.prototype.canonicalizedDomain = function canonicalizedDomain() {
   return canonicalDomain(this.domain);
 };
 
-function CookieJar(store, rejectPublicSuffixes) {
-  if (rejectPublicSuffixes != null) {
-    this.rejectPublicSuffixes = rejectPublicSuffixes;
+function CookieJar(store, options) {
+  if (typeof options === "boolean") {
+    options = {rejectPublicSuffixes: options};
+  } else if (options == null) {
+    options = {};
+  }
+  if (options.rejectPublicSuffixes != null) {
+    this.rejectPublicSuffixes = options.rejectPublicSuffixes;
+  }
+  if (options.looseMode != null) {
+    this.enableLooseMode = options.looseMode;
   }
 
   if (!store) {
@@ -870,6 +898,7 @@ function CookieJar(store, rejectPublicSuffixes) {
 }
 CookieJar.prototype.store = null;
 CookieJar.prototype.rejectPublicSuffixes = true;
+CookieJar.prototype.enableLooseMode = false;
 var CAN_BE_SYNC = [];
 
 CAN_BE_SYNC.push('setCookie');
@@ -882,10 +911,14 @@ CookieJar.prototype.setCookie = function(cookie, url, options, cb) {
   }
 
   var host = canonicalDomain(context.hostname);
+  var loose = this.enableLooseMode;
+  if (options.loose != null) {
+    loose = options.loose;
+  }
 
   // S5.3 step 1
   if (!(cookie instanceof Cookie)) {
-    cookie = Cookie.parse(cookie);
+    cookie = Cookie.parse(cookie, { loose: loose });
   }
   if (!cookie) {
     err = new Error("Cookie failed to parse");
@@ -1232,7 +1265,6 @@ CookieJar.deserialize = function(strOrObj, store, cb) {
   });
 };
 
-CookieJar.fromJSON = CookieJar.deserializeSync;
 CookieJar.deserializeSync = function(strOrObj, store) {
   var serialized = typeof strOrObj === 'string' ?
     JSON.parse(strOrObj) : strOrObj;
@@ -1246,6 +1278,7 @@ CookieJar.deserializeSync = function(strOrObj, store) {
   jar._importCookiesSync(serialized);
   return jar;
 };
+CookieJar.fromJSON = CookieJar.deserializeSync;
 
 CAN_BE_SYNC.push('clone');
 CookieJar.prototype.clone = function(newStore, cb) {