tough-cookie 5.1.2 → 6.0.0-rc.0

package/dist/cookie/canonicalDomain.d.ts

@@ -1,4 +1,4 @@
-import type { Nullable } from '../utils';
+import type { Nullable } from '../utils.js';
 /**
  * Transforms a domain name into a canonical domain name. The canonical domain name is a domain name
  * that has been trimmed, lowercased, stripped of leading dot, and optionally punycode-encoded

package/dist/cookie/canonicalDomain.js

@@ -1,7 +1,4 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.canonicalDomain = canonicalDomain;
-const constants_1 = require("./constants");
+import { IP_V6_REGEX_OBJECT } from './constants.js';
 /**
  * Normalizes a domain to lowercase and punycode-encoded.
  * Runtime-agnostic equivalent to node's `domainToASCII`.
@@ -41,12 +38,12 @@ function domainToASCII(domain) {
  * @param domainName - the domain name to generate the canonical domain from
  * @public
  */
-function canonicalDomain(domainName) {
+export function canonicalDomain(domainName) {
     if (domainName == null) {
         return undefined;
     }
     let str = domainName.trim().replace(/^\./, ''); // S4.1.2.3 & S5.2.3: ignore leading .
-    if (constants_1.IP_V6_REGEX_OBJECT.test(str)) {
+    if (IP_V6_REGEX_OBJECT.test(str)) {
         if (!str.startsWith('[')) {
             str = '[' + str;
         }

package/dist/cookie/constants.d.ts

@@ -17,6 +17,7 @@ export declare const PrefixSecurityEnum: {
     readonly DISABLED: "unsafe-disabled";
 };
 export declare const IP_V6_REGEX_OBJECT: RegExp;
+export declare const IP_V4_REGEX_OBJECT: RegExp;
 /**
  * A JSON representation of a {@link CookieJar}.
  * @public

package/dist/cookie/constants.js

@@ -1,6 +1,3 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.IP_V6_REGEX_OBJECT = exports.PrefixSecurityEnum = void 0;
 /**
  * Cookie prefixes are a way to indicate that a given cookie was set with a set of attributes simply by inspecting the
  * first few characters of the cookie's name. These are defined in {@link https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis-13#section-4.1.3 | RFC6265bis - Section 4.1.3}.
@@ -14,12 +11,12 @@ exports.IP_V6_REGEX_OBJECT = exports.PrefixSecurityEnum = void 0;
  * - `unsafe-disabled` - Disables cookie prefix checking.
  * @public
  */
-exports.PrefixSecurityEnum = {
+export const PrefixSecurityEnum = {
     SILENT: 'silent',
     STRICT: 'strict',
     DISABLED: 'unsafe-disabled',
 };
-Object.freeze(exports.PrefixSecurityEnum);
+Object.freeze(PrefixSecurityEnum);
 const IP_V6_REGEX = `
 \\[?(?:
 (?:[a-fA-F\\d]{1,4}:){7}(?:[a-fA-F\\d]{1,4}|:)|
@@ -35,4 +32,6 @@ const IP_V6_REGEX = `
     .replace(/\s*\/\/.*$/gm, '')
     .replace(/\n/g, '')
     .trim();
-exports.IP_V6_REGEX_OBJECT = new RegExp(`^${IP_V6_REGEX}$`);
+export const IP_V6_REGEX_OBJECT = new RegExp(`^${IP_V6_REGEX}$`);
+const IP_V4_REGEX = `(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])`;
+export const IP_V4_REGEX_OBJECT = new RegExp(`^${IP_V4_REGEX}$`);

package/dist/cookie/cookie.d.ts

@@ -1,4 +1,4 @@
-import type { SerializedCookie } from './constants';
+import type { SerializedCookie } from './constants.js';
 /**
  * Optional configuration to be used when parsing cookies.
  * @public

package/dist/cookie/cookie.js

@@ -1,29 +1,3 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.Cookie = void 0;
 /*!
  * Copyright (c) 2015-2020, Salesforce.com, Inc.
  * All rights reserved.
@@ -54,12 +28,12 @@ exports.Cookie = void 0;
  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  * POSSIBILITY OF SUCH DAMAGE.
  */
-const getPublicSuffix_1 = require("../getPublicSuffix");
-const validators = __importStar(require("../validators"));
-const utils_1 = require("../utils");
-const formatDate_1 = require("./formatDate");
-const parseDate_1 = require("./parseDate");
-const canonicalDomain_1 = require("./canonicalDomain");
+import { getPublicSuffix } from '../getPublicSuffix.js';
+import * as validators from '../validators.js';
+import { inOperator } from '../utils.js';
+import { formatDate } from './formatDate.js';
+import { parseDate } from './parseDate.js';
+import { canonicalDomain } from './canonicalDomain.js';
 // From RFC6265 S4.1.1
 // note that it excludes \x3B ";"
 const COOKIE_OCTETS = /^[\x21\x23-\x2B\x2D-\x3A\x3C-\x5B\x5D-\x7E]+$/;
@@ -174,7 +148,7 @@ function parse(str, options) {
         switch (av_key) {
             case 'expires': // S5.2.1
                 if (av_value) {
-                    const exp = (0, parseDate_1.parseDate)(av_value);
+                    const exp = parseDate(av_value);
                     // "If the attribute-value failed to parse as a cookie date, ignore the
                     // cookie-av."
                     if (exp) {
@@ -277,12 +251,12 @@ function fromJSON(str) {
     }
     const c = new Cookie();
     Cookie.serializableProperties.forEach((prop) => {
-        if (obj && typeof obj === 'object' && (0, utils_1.inOperator)(prop, obj)) {
+        if (obj && typeof obj === 'object' && inOperator(prop, obj)) {
             const val = obj[prop];
             if (val === undefined) {
                 return;
             }
-            if ((0, utils_1.inOperator)(prop, cookieDefaults) && val === cookieDefaults[prop]) {
+            if (inOperator(prop, cookieDefaults) && val === cookieDefaults[prop]) {
                 return;
             }
             switch (prop) {
@@ -364,7 +338,7 @@ const cookieDefaults = {
  * It is defined in {@link https://www.rfc-editor.org/rfc/rfc6265.html | RFC6265}.
  * @public
  */
-class Cookie {
+export class Cookie {
     /**
      * Create a new Cookie instance.
      * @public
@@ -500,7 +474,7 @@ class Cookie {
         }
         if (this.expires != 'Infinity' &&
             !(this.expires instanceof Date) &&
-            !(0, parseDate_1.parseDate)(this.expires)) {
+            !parseDate(this.expires)) {
             return false;
         }
         if (this.maxAge != null &&
@@ -516,7 +490,7 @@ class Cookie {
             if (cdomain.match(/\.$/)) {
                 return false; // S4.1.2.3 suggests that this is bad. domainMatch() tests confirm this
             }
-            const suffix = (0, getPublicSuffix_1.getPublicSuffix)(cdomain);
+            const suffix = getPublicSuffix(cdomain);
             if (suffix == null) {
                 // it's a public suffix
                 return false;
@@ -538,7 +512,7 @@ class Cookie {
             this.expires = exp;
         }
         else {
-            this.expires = (0, parseDate_1.parseDate)(exp) || 'Infinity';
+            this.expires = parseDate(exp) || 'Infinity';
         }
     }
     /**
@@ -579,7 +553,7 @@ class Cookie {
         let str = this.cookieString();
         if (this.expires != 'Infinity') {
             if (this.expires instanceof Date) {
-                str += `; Expires=${(0, formatDate_1.formatDate)(this.expires)}`;
+                str += `; Expires=${formatDate(this.expires)}`;
             }
         }
         if (this.maxAge != null && this.maxAge != Infinity) {
@@ -719,14 +693,14 @@ class Cookie {
      */
     canonicalizedDomain() {
         // Mostly S5.1.2 and S5.2.3:
-        return (0, canonicalDomain_1.canonicalDomain)(this.domain);
+        return canonicalDomain(this.domain);
     }
     /**
      * Alias for {@link Cookie.canonicalizedDomain}
      * @public
      */
     cdomain() {
-        return (0, canonicalDomain_1.canonicalDomain)(this.domain);
+        return canonicalDomain(this.domain);
     }
     /**
      * Parses a string into a Cookie object.
@@ -792,7 +766,6 @@ class Cookie {
         return fromJSON(str);
     }
 }
-exports.Cookie = Cookie;
 Cookie.cookiesCreated = 0;
 /**
  * @internal

package/dist/cookie/cookieCompare.d.ts

@@ -1,4 +1,4 @@
-import type { Cookie } from './cookie';
+import type { Cookie } from './cookie.js';
 /**
  * A comparison function that can be used with {@link https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/sort | Array.sort()},
  * which orders a list of cookies into the recommended order given in Step 2 of {@link https://www.rfc-editor.org/rfc/rfc6265.html#section-5.4 | RFC6265 - Section 5.4}.

package/dist/cookie/cookieCompare.js

@@ -1,6 +1,3 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.cookieCompare = cookieCompare;
 /**
  * The maximum timestamp a cookie, in milliseconds. The value is (2^31 - 1) seconds since the Unix
  * epoch, corresponding to 2038-01-19.
@@ -62,7 +59,7 @@ const MAX_TIME = 2147483647000;
  * @param b - the second Cookie for comparison
  * @public
  */
-function cookieCompare(a, b) {
+export function cookieCompare(a, b) {
     let cmp;
     // descending for length: b CMP a
     const aPathLen = a.path ? a.path.length : 0;

package/dist/cookie/cookieJar.d.ts

@@ -1,7 +1,7 @@
-import { Store } from '../store';
-import { Cookie } from './cookie';
-import { Callback, ErrorCallback, Nullable } from '../utils';
-import { SerializedCookieJar } from './constants';
+import { Store } from '../store.js';
+import { Cookie } from './cookie.js';
+import { Callback, ErrorCallback, Nullable } from '../utils.js';
+import { SerializedCookieJar } from './constants.js';
 /**
  * Configuration options used when calling `CookieJar.setCookie(...)`
  * @public
@@ -25,7 +25,7 @@ export interface SetCookieOptions {
      *
      * - `'none'` - This indicates a cross-origin request.
      *
-     * - `undefined` - SameSite is not be enforced! This can be a valid use-case for when
+     * - `undefined` - SameSite is not enforced! This can be a valid use-case for when
      *     CSRF isn't in the threat model of the system being built.
      *
      * Defaults to `undefined` if not provided.
@@ -71,7 +71,7 @@ export interface GetCookiesOptions {
      *
      * @remarks
      * - Using `false` returns expired cookies and does not remove them from the
-     *     store which is potentially useful for replaying `Set-Cookie` headers.
+     *     store, which is potentially useful for replaying `Set-Cookie` headers.
      *
      * Defaults to `true` if not provided.
      */
@@ -96,7 +96,7 @@ export interface GetCookiesOptions {
      *
      * - `'none'` - This indicates a cross-origin request.
      *
-     * - `undefined` - SameSite is not be enforced! This can be a valid use-case for when
+     * - `undefined` - SameSite is not enforced! This can be a valid use-case for when
      *     CSRF isn't in the threat model of the system being built.
      *
      * Defaults to `undefined` if not provided.
@@ -144,6 +144,19 @@ export interface CreateCookieJarOptions {
      * Defaults to `true` if not specified.
      */
     allowSpecialUseDomain?: boolean | undefined;
+    /**
+     * Flag to indicate if localhost and loopback addresses with an unsecure scheme should store and retrieve `Secure` cookies.
+     *
+     * If `true`, localhost, loopback addresses or similarly local addresses are treated as secure contexts
+     * and thus will store and retrieve `Secure` cookies even with an unsecure scheme.
+     *
+     * If `false`, only secure schemes (`https` and `wss`) will store and retrieve `Secure` cookies.
+     *
+     * @remarks
+     * When set to `true`, the {@link https://w3c.github.io/webappsec-secure-contexts/#potentially-trustworthy-origin | potentially trustworthy}
+     *  algorithm is followed to determine if a URL is considered a secure context.
+     */
+    allowSecureOnLocal?: boolean | undefined;
 }
 /**
  * A CookieJar is for storage and retrieval of {@link Cookie} objects as defined in
@@ -156,6 +169,7 @@ export declare class CookieJar {
     private readonly rejectPublicSuffixes;
     private readonly enableLooseMode;
     private readonly allowSpecialUseDomain;
+    private readonly allowSecureOnLocal;
     /**
      * The configured {@link Store} for the {@link CookieJar}.
      */
@@ -185,7 +199,7 @@ export declare class CookieJar {
      *     properties.
      *
      * - As per the RFC, the {@link Cookie.hostOnly} flag is set if there was no `Domain={value}`
-     *     atttribute on the cookie string. The {@link Cookie.domain} property is set to the
+     *     attribute on the cookie string. The {@link Cookie.domain} property is set to the
      *     fully-qualified hostname of `currentUrl` in this case. Matching this cookie requires an
      *     exact hostname match (not a {@link domainMatch} as per usual)
      *
@@ -204,7 +218,7 @@ export declare class CookieJar {
      *     properties.
      *
      * - As per the RFC, the {@link Cookie.hostOnly} flag is set if there was no `Domain={value}`
-     *     atttribute on the cookie string. The {@link Cookie.domain} property is set to the
+     *     attribute on the cookie string. The {@link Cookie.domain} property is set to the
      *     fully-qualified hostname of `currentUrl` in this case. Matching this cookie requires an
      *     exact hostname match (not a {@link domainMatch} as per usual)
      *
@@ -224,7 +238,7 @@ export declare class CookieJar {
      *     properties.
      *
      * - As per the RFC, the {@link Cookie.hostOnly} flag is set if there was no `Domain={value}`
-     *     atttribute on the cookie string. The {@link Cookie.domain} property is set to the
+     *     attribute on the cookie string. The {@link Cookie.domain} property is set to the
      *     fully-qualified hostname of `currentUrl` in this case. Matching this cookie requires an
      *     exact hostname match (not a {@link domainMatch} as per usual)
      *
@@ -249,7 +263,7 @@ export declare class CookieJar {
      *     properties.
      *
      * - As per the RFC, the {@link Cookie.hostOnly} flag is set if there was no `Domain={value}`
-     *     atttribute on the cookie string. The {@link Cookie.domain} property is set to the
+     *     attribute on the cookie string. The {@link Cookie.domain} property is set to the
      *     fully-qualified hostname of `currentUrl` in this case. Matching this cookie requires an
      *     exact hostname match (not a {@link domainMatch} as per usual)
      *