tough-cookie 6.0.0-rc.2 → 6.0.1

package/README.md

@@ -134,6 +134,44 @@ await cookieJar.setCookie(
 > [!NOTE]
 > It is highly recommended that you read [RFC6265bis - Section 4.1.3][cookie-prefixes-implementation] for more details on Cookie Prefixes.
 
+### Potentially Trustworthy Origins are considered "Secure"
+
+The definition of a "Secure" connection is not explicitly defined by [RFC6265bis][rfc6265bis-tracker] but the following text is
+provided in [RFC6265bis - Section 5.8.3][secure-connection-note]:
+
+> [!NOTE]
+> Typically, user agents consider a connection secure if the connection makes use of transport-layer security, such as
+> SSL or TLS, or if the host is trusted. For example, most user agents consider "https" to be a scheme that denotes a
+> secure protocol and "localhost" to be trusted host.
+
+As well as a note to [Appendix A. Changes from RFC6265][secure-connection-appendix-a] which refers to **"potentially trustworthy
+origins"** which are defined in the [Secure Contexts - W3C Candidate Recommendation Draft][potentially-trustworthy-origin]:
+
+> [!Note]
+> Considers potentially trustworthy origins as "secure".
+
+Since most web browsers treat `localhost` as a trustworthy origin, by default, so does `tough-cookie`. To disable this
+behavior, the `CookieStore` must be configured with:
+
+```typescript
+import { CookieJar, MemoryCookieStore } from 'tough-cookie'
+
+const cookieJar = new CookieJar(new MemoryCookieStore(), {
+  // add configuration so localhost will not be considered trustworthy
+  // (fyi - this doesn't apply to https cookies on localhost as those use a secure protocol)
+  allowSecureOnLocal: false,
+})
+
+// this cookie will be persisted to storage
+await cookieJar.setCookie(
+  'SID=12345; Domain=localhost; Secure;',
+  'http://localhost',
+)
+
+// but, on retrieval, it will not be returned
+await cookieJar.getCookiesSync('http://localhost')
+```
+
 ## Node.js Version Support
 
 We follow the [Node.js release schedule](https://github.com/nodejs/Release#release-schedule) and support
@@ -150,5 +188,8 @@ for older versions of node, and we will do so in consultation with our community
 [rfc6265bis-tracker]: https://datatracker.ietf.org/doc/draft-ietf-httpbis-rfc6265bis/
 [samesite-implementation]: https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis-02#section-8.8
 [cookie-prefixes-implementation]: https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis-02#section-4.1.3
+[secure-connection-note]: https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis-19#section-5.8.3-2.1.2.3.1
+[secure-connection-appendix-a]: https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis-19#appendix-A-1.7.1
+[potentially-trustworthy-origin]: https://www.w3.org/TR/secure-contexts/#is-origin-trustworthy
 [prs-welcome-badge]: https://img.shields.io/badge/PRs-welcome-brightgreen.svg
 [yarn-repo]: https://yarnpkg.com/package?name=tough-cookie

package/dist/index.cjs

@@ -428,7 +428,7 @@ var ParameterError = class extends Error {
 };
 
 // lib/version.ts
-var version = "6.0.0-rc.2";
+var version = "6.0.1";
 
 // lib/cookie/constants.ts
 var PrefixSecurityEnum = {
@@ -483,145 +483,114 @@ function formatDate(date) {
 }
 
 // lib/cookie/parseDate.ts
-var DATE_DELIM = /[\x09\x20-\x2F\x3B-\x40\x5B-\x60\x7B-\x7E]/;
-var MONTH_TO_NUM = {
-  jan: 0,
-  feb: 1,
-  mar: 2,
-  apr: 3,
-  may: 4,
-  jun: 5,
-  jul: 6,
-  aug: 7,
-  sep: 8,
-  oct: 9,
-  nov: 10,
-  dec: 11
-};
-function parseDigits(token, minDigits, maxDigits, trailingOK) {
-  let count = 0;
-  while (count < token.length) {
-    const c = token.charCodeAt(count);
-    if (c <= 47 || c >= 58) {
-      break;
-    }
-    count++;
-  }
-  if (count < minDigits || count > maxDigits) {
-    return;
-  }
-  if (!trailingOK && count != token.length) {
-    return;
-  }
-  return parseInt(token.slice(0, count), 10);
-}
-function parseTime(token) {
-  const parts = token.split(":");
-  const result = [0, 0, 0];
-  if (parts.length !== 3) {
-    return;
-  }
-  for (let i = 0; i < 3; i++) {
-    const trailingOK = i == 2;
-    const numPart = parts[i];
-    if (numPart === void 0) {
-      return;
-    }
-    const num = parseDigits(numPart, 1, 2, trailingOK);
-    if (num === void 0) {
-      return;
-    }
-    result[i] = num;
-  }
-  return result;
-}
-function parseMonth(token) {
-  token = String(token).slice(0, 3).toLowerCase();
-  switch (token) {
-    case "jan":
-      return MONTH_TO_NUM.jan;
-    case "feb":
-      return MONTH_TO_NUM.feb;
-    case "mar":
-      return MONTH_TO_NUM.mar;
-    case "apr":
-      return MONTH_TO_NUM.apr;
-    case "may":
-      return MONTH_TO_NUM.may;
-    case "jun":
-      return MONTH_TO_NUM.jun;
-    case "jul":
-      return MONTH_TO_NUM.jul;
-    case "aug":
-      return MONTH_TO_NUM.aug;
-    case "sep":
-      return MONTH_TO_NUM.sep;
-    case "oct":
-      return MONTH_TO_NUM.oct;
-    case "nov":
-      return MONTH_TO_NUM.nov;
-    case "dec":
-      return MONTH_TO_NUM.dec;
-    default:
-      return;
-  }
-}
 function parseDate(cookieDate) {
   if (!cookieDate) {
-    return;
-  }
-  const tokens = cookieDate.split(DATE_DELIM);
-  let hour;
-  let minute;
-  let second;
-  let dayOfMonth;
-  let month;
-  let year;
-  for (let i = 0; i < tokens.length; i++) {
-    const token = (tokens[i] ?? "").trim();
-    if (!token.length) {
-      continue;
-    }
-    if (second === void 0) {
-      const result = parseTime(token);
-      if (result) {
-        hour = result[0];
-        minute = result[1];
-        second = result[2];
-        continue;
+    return void 0;
+  }
+  const flags = {
+    foundTime: void 0,
+    foundDayOfMonth: void 0,
+    foundMonth: void 0,
+    foundYear: void 0
+  };
+  const dateTokens = cookieDate.split(DELIMITER).filter((token) => token.length > 0);
+  for (const dateToken of dateTokens) {
+    if (flags.foundTime === void 0) {
+      const [, hours, minutes, seconds] = TIME.exec(dateToken) || [];
+      if (hours != void 0 && minutes != void 0 && seconds != void 0) {
+        const parsedHours = parseInt(hours, 10);
+        const parsedMinutes = parseInt(minutes, 10);
+        const parsedSeconds = parseInt(seconds, 10);
+        if (!isNaN(parsedHours) && !isNaN(parsedMinutes) && !isNaN(parsedSeconds)) {
+          flags.foundTime = {
+            hours: parsedHours,
+            minutes: parsedMinutes,
+            seconds: parsedSeconds
+          };
+          continue;
+        }
       }
     }
-    if (dayOfMonth === void 0) {
-      const result = parseDigits(token, 1, 2, true);
-      if (result !== void 0) {
-        dayOfMonth = result;
+    if (flags.foundDayOfMonth === void 0 && DAY_OF_MONTH.test(dateToken)) {
+      const dayOfMonth = parseInt(dateToken, 10);
+      if (!isNaN(dayOfMonth)) {
+        flags.foundDayOfMonth = dayOfMonth;
         continue;
       }
     }
-    if (month === void 0) {
-      const result = parseMonth(token);
-      if (result !== void 0) {
-        month = result;
+    if (flags.foundMonth === void 0 && MONTH.test(dateToken)) {
+      const month = months.indexOf(dateToken.substring(0, 3).toLowerCase());
+      if (month >= 0 && month <= 11) {
+        flags.foundMonth = month;
         continue;
       }
     }
-    if (year === void 0) {
-      const result = parseDigits(token, 2, 4, true);
-      if (result !== void 0) {
-        year = result;
-        if (year >= 70 && year <= 99) {
-          year += 1900;
-        } else if (year >= 0 && year <= 69) {
-          year += 2e3;
-        }
+    if (flags.foundYear === void 0 && YEAR.test(dateToken)) {
+      const parsedYear = parseInt(dateToken, 10);
+      if (!isNaN(parsedYear)) {
+        flags.foundYear = parsedYear;
+        continue;
       }
     }
   }
-  if (dayOfMonth === void 0 || month === void 0 || year === void 0 || hour === void 0 || minute === void 0 || second === void 0 || dayOfMonth < 1 || dayOfMonth > 31 || year < 1601 || hour > 23 || minute > 59 || second > 59) {
-    return;
+  if (flags.foundYear !== void 0 && flags.foundYear >= 70 && flags.foundYear <= 99) {
+    flags.foundYear += 1900;
+  }
+  if (flags.foundYear !== void 0 && flags.foundYear >= 0 && flags.foundYear <= 69) {
+    flags.foundYear += 2e3;
+  }
+  if (flags.foundDayOfMonth === void 0 || flags.foundMonth === void 0 || flags.foundYear === void 0 || flags.foundTime === void 0) {
+    return void 0;
+  }
+  if (flags.foundDayOfMonth < 1 || flags.foundDayOfMonth > 31) {
+    return void 0;
+  }
+  if (flags.foundYear < 1601) {
+    return void 0;
   }
-  return new Date(Date.UTC(year, month, dayOfMonth, hour, minute, second));
+  if (flags.foundTime.hours > 23) {
+    return void 0;
+  }
+  if (flags.foundTime.minutes > 59) {
+    return void 0;
+  }
+  if (flags.foundTime.seconds > 59) {
+    return void 0;
+  }
+  const date = new Date(
+    Date.UTC(
+      flags.foundYear,
+      flags.foundMonth,
+      flags.foundDayOfMonth,
+      flags.foundTime.hours,
+      flags.foundTime.minutes,
+      flags.foundTime.seconds
+    )
+  );
+  if (date.getUTCFullYear() !== flags.foundYear || date.getUTCMonth() !== flags.foundMonth || date.getUTCDate() !== flags.foundDayOfMonth) {
+    return void 0;
+  }
+  return date;
 }
+var months = [
+  "jan",
+  "feb",
+  "mar",
+  "apr",
+  "may",
+  "jun",
+  "jul",
+  "aug",
+  "sep",
+  "oct",
+  "nov",
+  "dec"
+];
+var DELIMITER = /[\x09\x20-\x2F\x3B-\x40\x5B-\x60\x7B-\x7E]/;
+var TIME = /^(\d{1,2}):(\d{1,2}):(\d{1,2})(?:[\x00-\x2F\x3A-\xFF][\x00-\xFF]*)?$/;
+var DAY_OF_MONTH = /^[0-9]{1,2}(?:[\x00-\x2F\x3A-\xFF][\x00-\xFF]*)?$/;
+var MONTH = /^(jan|feb|mar|apr|may|jun|jul|aug|sep|oct|nov|dec)[\x00-\xFF]*$/i;
+var YEAR = /^[\x30-\x39]{2,4}(?:[\x00-\x2F\x3A-\xFF][\x00-\xFF]*)?$/;
 
 // lib/cookie/cookie.ts
 var COOKIE_OCTETS = /^[\x21\x23-\x2B\x2D-\x3A\x3C-\x5B\x5D-\x7E]+$/;
@@ -886,7 +855,7 @@ var _Cookie = class _Cookie {
     });
     this.creationIndex = _Cookie.cookiesCreated;
   }
-  [Symbol.for("nodejs.util.inspect.custom")]() {
+  [/* @__PURE__ */ Symbol.for("nodejs.util.inspect.custom")]() {
     const now = Date.now();
     const hostOnly = this.hostOnly != null ? this.hostOnly.toString() : "?";
     const createAge = this.creation && this.creation !== "Infinity" ? `${String(now - this.creation.getTime())}ms` : "?";