tough-cookie 6.0.0 → 6.0.2

package/dist/index.d.cts

@@ -928,7 +928,7 @@ declare class ParameterError extends Error {
  * The version of `tough-cookie`
  * @public
  */
-declare const version = "6.0.0";
+declare const version = "6.0.2";
 
 /**
  * Transforms a domain name into a canonical domain name. The canonical domain name is a domain name
@@ -1699,6 +1699,10 @@ declare function defaultPath(path?: Nullable<string>): string;
  * but it helps to think of it as a "suffix match".
  *
  * @remarks
+ * This implementation is compliant with RFC6265 Section 5.1.3 and compatible with
+ * {@link https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis-22#section-5.1.3 | draft-ietf-httpbis-rfc6265bis-22}
+ * which adds a clarifying note that both inputs must be canonicalized but is otherwise identical.
+ *
  * ### 5.1.3.  Domain Matching
  *
  * A string domain-matches a given domain string if at least one of the
@@ -1754,91 +1758,13 @@ declare function formatDate(date: Date): string;
  *
  * @remarks
  *
- * ### RFC6265 - 5.1.1. Dates
- *
- * The user agent MUST use an algorithm equivalent to the following
- * algorithm to parse a cookie-date.  Note that the various boolean
- * flags defined as a part of the algorithm (i.e., found-time, found-
- * day-of-month, found-month, found-year) are initially "not set".
- *
- * 1.  Using the grammar below, divide the cookie-date into date-tokens.
- *
- * ```
- *     cookie-date     = *delimiter date-token-list *delimiter
- *     date-token-list = date-token *( 1*delimiter date-token )
- *     date-token      = 1*non-delimiter
- *
- *     delimiter       = %x09 / %x20-2F / %x3B-40 / %x5B-60 / %x7B-7E
- *     non-delimiter   = %x00-08 / %x0A-1F / DIGIT / ":" / ALPHA / %x7F-FF
- *     non-digit       = %x00-2F / %x3A-FF
- *
- *     day-of-month    = 1*2DIGIT ( non-digit *OCTET )
- *     month           = ( "jan" / "feb" / "mar" / "apr" /
- *                        "may" / "jun" / "jul" / "aug" /
- *                        "sep" / "oct" / "nov" / "dec" ) *OCTET
- *     year            = 2*4DIGIT ( non-digit *OCTET )
- *     time            = hms-time ( non-digit *OCTET )
- *     hms-time        = time-field ":" time-field ":" time-field
- *     time-field      = 1*2DIGIT
- * ```
- *
- * 2. Process each date-token sequentially in the order the date-tokens
- *     appear in the cookie-date:
- *
- *     1. If the found-time flag is not set and the token matches the
- *         time production, set the found-time flag and set the hour-
- *         value, minute-value, and second-value to the numbers denoted
- *         by the digits in the date-token, respectively.  Skip the
- *         remaining sub-steps and continue to the next date-token.
- *
- *     2. If the found-day-of-month flag is not set and the date-token
- *         matches the day-of-month production, set the found-day-of-
- *         month flag and set the day-of-month-value to the number
- *         denoted by the date-token.  Skip the remaining sub-steps and
- *         continue to the next date-token.
- *
- *     3. If the found-month flag is not set and the date-token matches
- *         the month production, set the found-month flag and set the
- *         month-value to the month denoted by the date-token.  Skip the
- *         remaining sub-steps and continue to the next date-token.
- *
- *     4. If the found-year flag is not set and the date-token matches
- *         the year production, set the found-year flag and set the
- *         year-value to the number denoted by the date-token.  Skip the
- *         remaining sub-steps and continue to the next date-token.
- *
- *  3. If the year-value is greater than or equal to 70 and less than or
- *      equal to 99, increment the year-value by 1900.
- *
- *  4. If the year-value is greater than or equal to 0 and less than or
- *      equal to 69, increment the year-value by 2000.
- *
- *      1. NOTE: Some existing user agents interpret two-digit years differently.
- *
- *  5. Abort these steps and fail to parse the cookie-date if:
- *
- *      - at least one of the found-day-of-month, found-month, found-
- *          year, or found-time flags is not set,
- *
- *      - the day-of-month-value is less than 1 or greater than 31,
- *
- *      - the year-value is less than 1601,
- *
- *      - the hour-value is greater than 23,
- *
- *      - the minute-value is greater than 59, or
- *
- *      - the second-value is greater than 59.
- *
- *      (Note that leap seconds cannot be represented in this syntax.)
- *
- *  6. Let the parsed-cookie-date be the date whose day-of-month, month,
- *      year, hour, minute, and second (in UTC) are the day-of-month-
- *      value, the month-value, the year-value, the hour-value, the
- *      minute-value, and the second-value, respectively.  If no such
- *      date exists, abort these steps and fail to parse the cookie-date.
+ * This implementation is compliant with RFC6265 Section 5.1.1 and incorporates
+ * {@link https://www.rfc-editor.org/errata/eid4148 | RFC6265 Erratum 4148 - Grammar Fixed}
+ * which corrects the ABNF grammar for day-of-month, year, and time to make trailing
+ * non-digit characters optional (changing `( )` to `[ ]`).
  *
- *  7. Return the parsed-cookie-date as the result of this algorithm.
+ * Also compatible with {@link https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis-21 | draft-ietf-httpbis-rfc6265bis-21}
+ * which maintains the same date parsing algorithm with additional clarifications.
  *
  * @example
  * ```
@@ -1846,6 +1772,7 @@ declare function formatDate(date: Date): string;
  * ```
  *
  * @param cookieDate - the cookie date string
+ * @returns Date if valid, undefined if invalid
  * @public
  */
 declare function parseDate(cookieDate: Nullable<string>): Date | undefined;

package/dist/index.d.ts

@@ -928,7 +928,7 @@ declare class ParameterError extends Error {
  * The version of `tough-cookie`
  * @public
  */
-declare const version = "6.0.0";
+declare const version = "6.0.2";
 
 /**
  * Transforms a domain name into a canonical domain name. The canonical domain name is a domain name
@@ -1699,6 +1699,10 @@ declare function defaultPath(path?: Nullable<string>): string;
  * but it helps to think of it as a "suffix match".
  *
  * @remarks
+ * This implementation is compliant with RFC6265 Section 5.1.3 and compatible with
+ * {@link https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis-22#section-5.1.3 | draft-ietf-httpbis-rfc6265bis-22}
+ * which adds a clarifying note that both inputs must be canonicalized but is otherwise identical.
+ *
  * ### 5.1.3.  Domain Matching
  *
  * A string domain-matches a given domain string if at least one of the
@@ -1754,91 +1758,13 @@ declare function formatDate(date: Date): string;
  *
  * @remarks
  *
- * ### RFC6265 - 5.1.1. Dates
- *
- * The user agent MUST use an algorithm equivalent to the following
- * algorithm to parse a cookie-date.  Note that the various boolean
- * flags defined as a part of the algorithm (i.e., found-time, found-
- * day-of-month, found-month, found-year) are initially "not set".
- *
- * 1.  Using the grammar below, divide the cookie-date into date-tokens.
- *
- * ```
- *     cookie-date     = *delimiter date-token-list *delimiter
- *     date-token-list = date-token *( 1*delimiter date-token )
- *     date-token      = 1*non-delimiter
- *
- *     delimiter       = %x09 / %x20-2F / %x3B-40 / %x5B-60 / %x7B-7E
- *     non-delimiter   = %x00-08 / %x0A-1F / DIGIT / ":" / ALPHA / %x7F-FF
- *     non-digit       = %x00-2F / %x3A-FF
- *
- *     day-of-month    = 1*2DIGIT ( non-digit *OCTET )
- *     month           = ( "jan" / "feb" / "mar" / "apr" /
- *                        "may" / "jun" / "jul" / "aug" /
- *                        "sep" / "oct" / "nov" / "dec" ) *OCTET
- *     year            = 2*4DIGIT ( non-digit *OCTET )
- *     time            = hms-time ( non-digit *OCTET )
- *     hms-time        = time-field ":" time-field ":" time-field
- *     time-field      = 1*2DIGIT
- * ```
- *
- * 2. Process each date-token sequentially in the order the date-tokens
- *     appear in the cookie-date:
- *
- *     1. If the found-time flag is not set and the token matches the
- *         time production, set the found-time flag and set the hour-
- *         value, minute-value, and second-value to the numbers denoted
- *         by the digits in the date-token, respectively.  Skip the
- *         remaining sub-steps and continue to the next date-token.
- *
- *     2. If the found-day-of-month flag is not set and the date-token
- *         matches the day-of-month production, set the found-day-of-
- *         month flag and set the day-of-month-value to the number
- *         denoted by the date-token.  Skip the remaining sub-steps and
- *         continue to the next date-token.
- *
- *     3. If the found-month flag is not set and the date-token matches
- *         the month production, set the found-month flag and set the
- *         month-value to the month denoted by the date-token.  Skip the
- *         remaining sub-steps and continue to the next date-token.
- *
- *     4. If the found-year flag is not set and the date-token matches
- *         the year production, set the found-year flag and set the
- *         year-value to the number denoted by the date-token.  Skip the
- *         remaining sub-steps and continue to the next date-token.
- *
- *  3. If the year-value is greater than or equal to 70 and less than or
- *      equal to 99, increment the year-value by 1900.
- *
- *  4. If the year-value is greater than or equal to 0 and less than or
- *      equal to 69, increment the year-value by 2000.
- *
- *      1. NOTE: Some existing user agents interpret two-digit years differently.
- *
- *  5. Abort these steps and fail to parse the cookie-date if:
- *
- *      - at least one of the found-day-of-month, found-month, found-
- *          year, or found-time flags is not set,
- *
- *      - the day-of-month-value is less than 1 or greater than 31,
- *
- *      - the year-value is less than 1601,
- *
- *      - the hour-value is greater than 23,
- *
- *      - the minute-value is greater than 59, or
- *
- *      - the second-value is greater than 59.
- *
- *      (Note that leap seconds cannot be represented in this syntax.)
- *
- *  6. Let the parsed-cookie-date be the date whose day-of-month, month,
- *      year, hour, minute, and second (in UTC) are the day-of-month-
- *      value, the month-value, the year-value, the hour-value, the
- *      minute-value, and the second-value, respectively.  If no such
- *      date exists, abort these steps and fail to parse the cookie-date.
+ * This implementation is compliant with RFC6265 Section 5.1.1 and incorporates
+ * {@link https://www.rfc-editor.org/errata/eid4148 | RFC6265 Erratum 4148 - Grammar Fixed}
+ * which corrects the ABNF grammar for day-of-month, year, and time to make trailing
+ * non-digit characters optional (changing `( )` to `[ ]`).
  *
- *  7. Return the parsed-cookie-date as the result of this algorithm.
+ * Also compatible with {@link https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis-21 | draft-ietf-httpbis-rfc6265bis-21}
+ * which maintains the same date parsing algorithm with additional clarifications.
  *
  * @example
  * ```
@@ -1846,6 +1772,7 @@ declare function formatDate(date: Date): string;
  * ```
  *
  * @param cookieDate - the cookie date string
+ * @returns Date if valid, undefined if invalid
  * @public
  */
 declare function parseDate(cookieDate: Nullable<string>): Date | undefined;

package/dist/index.js

@@ -384,7 +384,7 @@ var ParameterError = class extends Error {
 };
 
 // lib/version.ts
-var version = "6.0.0";
+var version = "6.0.2";
 
 // lib/cookie/constants.ts
 var PrefixSecurityEnum = {
@@ -439,145 +439,114 @@ function formatDate(date) {
 }
 
 // lib/cookie/parseDate.ts
-var DATE_DELIM = /[\x09\x20-\x2F\x3B-\x40\x5B-\x60\x7B-\x7E]/;
-var MONTH_TO_NUM = {
-  jan: 0,
-  feb: 1,
-  mar: 2,
-  apr: 3,
-  may: 4,
-  jun: 5,
-  jul: 6,
-  aug: 7,
-  sep: 8,
-  oct: 9,
-  nov: 10,
-  dec: 11
-};
-function parseDigits(token, minDigits, maxDigits, trailingOK) {
-  let count = 0;
-  while (count < token.length) {
-    const c = token.charCodeAt(count);
-    if (c <= 47 || c >= 58) {
-      break;
-    }
-    count++;
-  }
-  if (count < minDigits || count > maxDigits) {
-    return;
-  }
-  if (!trailingOK && count != token.length) {
-    return;
-  }
-  return parseInt(token.slice(0, count), 10);
-}
-function parseTime(token) {
-  const parts = token.split(":");
-  const result = [0, 0, 0];
-  if (parts.length !== 3) {
-    return;
-  }
-  for (let i = 0; i < 3; i++) {
-    const trailingOK = i == 2;
-    const numPart = parts[i];
-    if (numPart === void 0) {
-      return;
-    }
-    const num = parseDigits(numPart, 1, 2, trailingOK);
-    if (num === void 0) {
-      return;
-    }
-    result[i] = num;
-  }
-  return result;
-}
-function parseMonth(token) {
-  token = String(token).slice(0, 3).toLowerCase();
-  switch (token) {
-    case "jan":
-      return MONTH_TO_NUM.jan;
-    case "feb":
-      return MONTH_TO_NUM.feb;
-    case "mar":
-      return MONTH_TO_NUM.mar;
-    case "apr":
-      return MONTH_TO_NUM.apr;
-    case "may":
-      return MONTH_TO_NUM.may;
-    case "jun":
-      return MONTH_TO_NUM.jun;
-    case "jul":
-      return MONTH_TO_NUM.jul;
-    case "aug":
-      return MONTH_TO_NUM.aug;
-    case "sep":
-      return MONTH_TO_NUM.sep;
-    case "oct":
-      return MONTH_TO_NUM.oct;
-    case "nov":
-      return MONTH_TO_NUM.nov;
-    case "dec":
-      return MONTH_TO_NUM.dec;
-    default:
-      return;
-  }
-}
 function parseDate(cookieDate) {
   if (!cookieDate) {
-    return;
-  }
-  const tokens = cookieDate.split(DATE_DELIM);
-  let hour;
-  let minute;
-  let second;
-  let dayOfMonth;
-  let month;
-  let year;
-  for (let i = 0; i < tokens.length; i++) {
-    const token = (tokens[i] ?? "").trim();
-    if (!token.length) {
-      continue;
-    }
-    if (second === void 0) {
-      const result = parseTime(token);
-      if (result) {
-        hour = result[0];
-        minute = result[1];
-        second = result[2];
-        continue;
+    return void 0;
+  }
+  const flags = {
+    foundTime: void 0,
+    foundDayOfMonth: void 0,
+    foundMonth: void 0,
+    foundYear: void 0
+  };
+  const dateTokens = cookieDate.split(DELIMITER).filter((token) => token.length > 0);
+  for (const dateToken of dateTokens) {
+    if (flags.foundTime === void 0) {
+      const [, hours, minutes, seconds] = TIME.exec(dateToken) || [];
+      if (hours != void 0 && minutes != void 0 && seconds != void 0) {
+        const parsedHours = parseInt(hours, 10);
+        const parsedMinutes = parseInt(minutes, 10);
+        const parsedSeconds = parseInt(seconds, 10);
+        if (!isNaN(parsedHours) && !isNaN(parsedMinutes) && !isNaN(parsedSeconds)) {
+          flags.foundTime = {
+            hours: parsedHours,
+            minutes: parsedMinutes,
+            seconds: parsedSeconds
+          };
+          continue;
+        }
       }
     }
-    if (dayOfMonth === void 0) {
-      const result = parseDigits(token, 1, 2, true);
-      if (result !== void 0) {
-        dayOfMonth = result;
+    if (flags.foundDayOfMonth === void 0 && DAY_OF_MONTH.test(dateToken)) {
+      const dayOfMonth = parseInt(dateToken, 10);
+      if (!isNaN(dayOfMonth)) {
+        flags.foundDayOfMonth = dayOfMonth;
         continue;
       }
     }
-    if (month === void 0) {
-      const result = parseMonth(token);
-      if (result !== void 0) {
-        month = result;
+    if (flags.foundMonth === void 0 && MONTH.test(dateToken)) {
+      const month = months.indexOf(dateToken.substring(0, 3).toLowerCase());
+      if (month >= 0 && month <= 11) {
+        flags.foundMonth = month;
         continue;
       }
     }
-    if (year === void 0) {
-      const result = parseDigits(token, 2, 4, true);
-      if (result !== void 0) {
-        year = result;
-        if (year >= 70 && year <= 99) {
-          year += 1900;
-        } else if (year >= 0 && year <= 69) {
-          year += 2e3;
-        }
+    if (flags.foundYear === void 0 && YEAR.test(dateToken)) {
+      const parsedYear = parseInt(dateToken, 10);
+      if (!isNaN(parsedYear)) {
+        flags.foundYear = parsedYear;
+        continue;
       }
     }
   }
-  if (dayOfMonth === void 0 || month === void 0 || year === void 0 || hour === void 0 || minute === void 0 || second === void 0 || dayOfMonth < 1 || dayOfMonth > 31 || year < 1601 || hour > 23 || minute > 59 || second > 59) {
-    return;
+  if (flags.foundYear !== void 0 && flags.foundYear >= 70 && flags.foundYear <= 99) {
+    flags.foundYear += 1900;
+  }
+  if (flags.foundYear !== void 0 && flags.foundYear >= 0 && flags.foundYear <= 69) {
+    flags.foundYear += 2e3;
+  }
+  if (flags.foundDayOfMonth === void 0 || flags.foundMonth === void 0 || flags.foundYear === void 0 || flags.foundTime === void 0) {
+    return void 0;
+  }
+  if (flags.foundDayOfMonth < 1 || flags.foundDayOfMonth > 31) {
+    return void 0;
+  }
+  if (flags.foundYear < 1601) {
+    return void 0;
+  }
+  if (flags.foundTime.hours > 23) {
+    return void 0;
+  }
+  if (flags.foundTime.minutes > 59) {
+    return void 0;
   }
-  return new Date(Date.UTC(year, month, dayOfMonth, hour, minute, second));
+  if (flags.foundTime.seconds > 59) {
+    return void 0;
+  }
+  const date = new Date(
+    Date.UTC(
+      flags.foundYear,
+      flags.foundMonth,
+      flags.foundDayOfMonth,
+      flags.foundTime.hours,
+      flags.foundTime.minutes,
+      flags.foundTime.seconds
+    )
+  );
+  if (date.getUTCFullYear() !== flags.foundYear || date.getUTCMonth() !== flags.foundMonth || date.getUTCDate() !== flags.foundDayOfMonth) {
+    return void 0;
+  }
+  return date;
 }
+var months = [
+  "jan",
+  "feb",
+  "mar",
+  "apr",
+  "may",
+  "jun",
+  "jul",
+  "aug",
+  "sep",
+  "oct",
+  "nov",
+  "dec"
+];
+var DELIMITER = /[\x09\x20-\x2F\x3B-\x40\x5B-\x60\x7B-\x7E]/;
+var TIME = /^(\d{1,2}):(\d{1,2}):(\d{1,2})(?:[\x00-\x2F\x3A-\xFF][\x00-\xFF]*)?$/;
+var DAY_OF_MONTH = /^[0-9]{1,2}(?:[\x00-\x2F\x3A-\xFF][\x00-\xFF]*)?$/;
+var MONTH = /^(jan|feb|mar|apr|may|jun|jul|aug|sep|oct|nov|dec)[\x00-\xFF]*$/i;
+var YEAR = /^[\x30-\x39]{2,4}(?:[\x00-\x2F\x3A-\xFF][\x00-\xFF]*)?$/;
 
 // lib/cookie/cookie.ts
 var COOKIE_OCTETS = /^[\x21\x23-\x2B\x2D-\x3A\x3C-\x5B\x5D-\x7E]+$/;
@@ -842,7 +811,7 @@ var _Cookie = class _Cookie {
     });
     this.creationIndex = _Cookie.cookiesCreated;
   }
-  [Symbol.for("nodejs.util.inspect.custom")]() {
+  [/* @__PURE__ */ Symbol.for("nodejs.util.inspect.custom")]() {
     const now = Date.now();
     const hostOnly = this.hostOnly != null ? this.hostOnly.toString() : "?";
     const createAge = this.creation && this.creation !== "Infinity" ? `${String(now - this.creation.getTime())}ms` : "?";
@@ -1373,17 +1342,23 @@ function getCookieContext(url) {
       protocol: url.protocol
     };
   } else if (typeof url === "string") {
+    const parsed = new URL(url);
+    let pathname = parsed.pathname;
     try {
-      return new URL(decodeURI(url));
+      pathname = decodeURI(pathname);
     } catch {
-      return new URL(url);
     }
+    return {
+      hostname: parsed.hostname,
+      pathname,
+      protocol: parsed.protocol
+    };
   } else {
     throw new ParameterError("`url` argument is not a string or URL.");
   }
 }
 function checkSameSiteContext(value) {
-  const context = String(value).toLowerCase();
+  const context = value.toLowerCase();
   if (context === "none" || context === "lax" || context === "strict") {
     return context;
   } else {