tough-cookie 6.0.1 → 6.1.0

package/README.md

@@ -24,16 +24,20 @@ import { Cookie, CookieJar } from 'tough-cookie'
 // parse a `Cookie` request header
 const reqCookies = 'ID=298zf09hf012fh2; csrf=u32t4o3tb3gg43; _gat=1'
   .split(';')
-  .map(Cookie.parse)
+  .map((str) => Cookie.parse(str))
+  .filter((cookie) => cookie !== undefined)
 // generate a `Cookie` request header
-const cookieHeader = reqCookies.map((cookie) => cookie.cookieString()).join(';')
+const cookieHeader = reqCookies
+  .map((cookie) => cookie.cookieString())
+  .join('; ')
 
 // parse a Set-Cookie response header
 const resCookie = Cookie.parse(
-  'foo=bar; Domain=example.com; Path=/; Expires=Tue, 21 Oct 2025 00:00:00 GMT',
+  'foo=bar; Domain=example.com; Path=/; Max-Age=3600',
 )
+if (!resCookie) throw new Error('invalid Set-Cookie header')
 // generate a Set-Cookie response header
-const setCookieHeader = cookie.toString()
+const setCookieHeader = resCookie.toString()
 
 // store and retrieve cookies
 const cookieJar = new CookieJar() // uses the in-memory store by default
@@ -46,7 +50,7 @@ const matchingCookies = await cookieJar.getCookies('https://example.com/')
 
 ## RFC6265bis
 
-Support for [RFC6265bis][rfc6265bis-tracker] is being developed. As these revisions to [RFC6252][rfc6265-tracker] are
+Support for [RFC6265bis][rfc6265bis-tracker] is being developed. As these revisions to [RFC6265][rfc6265-tracker] are
 still in `Active Internet-Draft` state, the areas of support that follow are subject to change.
 
 ### SameSite Cookies
@@ -118,10 +122,11 @@ const cookieJar = new CookieJar(new MemoryCookieStore(), {
   prefixSecurity: 'silent',
 })
 
-// this cookie will be silently ignored since the url is insecure (http)
+// ignoreError silences the general Secure-cookie origin rejection
 await cookieJar.setCookie(
   '__Secure-SID=12345; Domain=example.com; Secure;',
   'http://example.com',
+  { ignoreError: true },
 )
 
 // this cookie will be stored since the url is secure (https)
@@ -151,7 +156,7 @@ origins"** which are defined in the [Secure Contexts - W3C Candidate Recommendat
 > Considers potentially trustworthy origins as "secure".
 
 Since most web browsers treat `localhost` as a trustworthy origin, by default, so does `tough-cookie`. To disable this
-behavior, the `CookieStore` must be configured with:
+behavior, the `CookieJar` must be configured with:
 
 ```typescript
 import { CookieJar, MemoryCookieStore } from 'tough-cookie'
@@ -165,11 +170,34 @@ const cookieJar = new CookieJar(new MemoryCookieStore(), {
 // this cookie will be persisted to storage
 await cookieJar.setCookie(
   'SID=12345; Domain=localhost; Secure;',
-  'http://localhost',
+  'https://localhost',
 )
 
 // but, on retrieval, it will not be returned
-await cookieJar.getCookiesSync('http://localhost')
+const cookies = await cookieJar.getCookies('http://localhost')
+```
+
+Secure cookies set on an untrustworthy origin are rejected, including
+unprefixed cookies. `ignoreError: true` silently discards them; it does not
+store them. This origin check applies independently of `prefixSecurity`.
+
+To restore the previous behavior of storing Secure cookies regardless of the
+origin they were set from, the `CookieJar` must be configured with the following.
+This only affects storage; Secure cookies are still only returned for secure
+origins on retrieval.
+
+```typescript
+import { CookieJar, MemoryCookieStore } from 'tough-cookie'
+
+const cookieJar = new CookieJar(new MemoryCookieStore(), {
+  enforceSecureOriginOnStorage: false,
+})
+
+// this cookie will be persisted to storage
+await cookieJar.setCookie('SID=12345; Secure;', 'http://example.com')
+
+// but, on retrieval, it will only be returned for secure origins
+const cookies = await cookieJar.getCookies('https://example.com')
 ```
 
 ## Node.js Version Support
@@ -186,10 +214,10 @@ for older versions of node, and we will do so in consultation with our community
 [rfc6265-tracker]: https://datatracker.ietf.org/doc/rfc6265/
 [rfc6265bis-badge]: https://img.shields.io/badge/RFC-6265bis-flat?labelColor=000000&color=666666
 [rfc6265bis-tracker]: https://datatracker.ietf.org/doc/draft-ietf-httpbis-rfc6265bis/
-[samesite-implementation]: https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis-02#section-8.8
-[cookie-prefixes-implementation]: https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis-02#section-4.1.3
-[secure-connection-note]: https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis-19#section-5.8.3-2.1.2.3.1
-[secure-connection-appendix-a]: https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis-19#appendix-A-1.7.1
+[samesite-implementation]: https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis-22#section-8.8
+[cookie-prefixes-implementation]: https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis-22#section-4.1.3
+[secure-connection-note]: https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis-22#section-5.8.3
+[secure-connection-appendix-a]: https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis-22#appendix-A
 [potentially-trustworthy-origin]: https://www.w3.org/TR/secure-contexts/#is-origin-trustworthy
 [prs-welcome-badge]: https://img.shields.io/badge/PRs-welcome-brightgreen.svg
 [yarn-repo]: https://yarnpkg.com/package?name=tough-cookie

package/dist/index.cjs

@@ -428,7 +428,7 @@ var ParameterError = class extends Error {
 };
 
 // lib/version.ts
-var version = "6.0.1";
+var version = "6.1.0";
 
 // lib/cookie/constants.ts
 var PrefixSecurityEnum = {
@@ -482,6 +482,17 @@ function formatDate(date) {
   return date.toUTCString();
 }
 
+// lib/cookie/cookieName.ts
+var INVALID_TOKEN_CHARACTER = /[^\x21\x23-\x27\x2A\x2B\x2D\x2E\x30-\x39\x41-\x5A\x5E-\x7A\x7C\x7E]/;
+var CookieName = {
+  parse(input) {
+    if (input.length === 0 || INVALID_TOKEN_CHARACTER.test(input)) {
+      return void 0;
+    }
+    return input;
+  }
+};
+
 // lib/cookie/parseDate.ts
 function parseDate(cookieDate) {
   if (!cookieDate) {
@@ -656,8 +667,8 @@ function parse(str, options) {
     return c;
   }
   const cookie_avs = unparsed.split(";");
-  while (cookie_avs.length) {
-    const av = (cookie_avs.shift() ?? "").trim();
+  for (const cookie_av of cookie_avs) {
+    const av = cookie_av.trim();
     if (av.length === 0) {
       continue;
     }
@@ -940,10 +951,17 @@ var _Cookie = class _Cookie {
    *
    * @remarks
    * Works for a few things, but is by no means comprehensive.
+   * Checks that the cookie name is a non-empty token as defined in RFC 6265 Section 4.1.1.
+   * Nameless cookies (including those parsed in loose mode or created with `new Cookie({ value })`)
+   * and names containing characters outside the token grammar (such as `a b`) return `false`.
+   * Parsing and storage remain permissive; this check only applies to explicit validation.
    *
    * @beta
    */
   validate() {
+    if (CookieName.parse(this.key) === void 0) {
+      return false;
+    }
     if (!this.value || !COOKIE_OCTETS.test(this.value)) {
       return false;
     }
@@ -962,7 +980,7 @@ var _Cookie = class _Cookie {
         return false;
       }
       const suffix = getPublicSuffix(cdomain);
-      if (suffix == null) {
+      if (suffix == null && !IP_V4_REGEX_OBJECT.test(cdomain) && !IP_V6_REGEX_OBJECT.test(cdomain)) {
         return false;
       }
     }
@@ -1038,11 +1056,13 @@ var _Cookie = class _Cookie {
     if (this.httpOnly) {
       str += "; HttpOnly";
     }
-    if (this.sameSite && this.sameSite !== "none") {
+    if (this.sameSite) {
       if (this.sameSite.toLowerCase() === _Cookie.sameSiteCanonical.lax.toLowerCase()) {
         str += `; SameSite=${_Cookie.sameSiteCanonical.lax}`;
       } else if (this.sameSite.toLowerCase() === _Cookie.sameSiteCanonical.strict.toLowerCase()) {
         str += `; SameSite=${_Cookie.sameSiteCanonical.strict}`;
+      } else if (this.sameSite.toLowerCase() === _Cookie.sameSiteCanonical.none.toLowerCase()) {
+        str += `; SameSite=${_Cookie.sameSiteCanonical.none}`;
       } else {
         str += `; SameSite=${this.sameSite}`;
       }
@@ -1089,6 +1109,9 @@ var _Cookie = class _Cookie {
    */
   expiryTime(now) {
     if (this.maxAge != null) {
+      if (this.maxAge === "Infinity") {
+        return Infinity;
+      }
       const relativeTo = now || this.lastAccessed || /* @__PURE__ */ new Date();
       const maxAge = typeof this.maxAge === "number" ? this.maxAge : -Infinity;
       const age = maxAge <= 0 ? -Infinity : maxAge * 1e3;
@@ -1221,7 +1244,8 @@ _Cookie.sameSiteLevel = {
  */
 _Cookie.sameSiteCanonical = {
   strict: "Strict",
-  lax: "Lax"
+  lax: "Lax",
+  none: "None"
 };
 /**
  * Cookie properties that will be serialized when using {@link Cookie.fromJSON} and {@link Cookie.toJSON}.
@@ -1380,23 +1404,34 @@ var defaultGetCookieOptions = {
 var SAME_SITE_CONTEXT_VAL_ERR = 'Invalid sameSiteContext option for getCookies(); expected one of "strict", "lax", or "none"';
 function getCookieContext(url) {
   if (url && typeof url === "object" && "hostname" in url && typeof url.hostname === "string" && "pathname" in url && typeof url.pathname === "string" && "protocol" in url && typeof url.protocol === "string") {
+    let pathname = url.pathname;
+    try {
+      pathname = decodeURI(pathname);
+    } catch {
+    }
     return {
       hostname: url.hostname,
-      pathname: url.pathname,
+      pathname,
       protocol: url.protocol
     };
   } else if (typeof url === "string") {
+    const parsed = new URL(url);
+    let pathname = parsed.pathname;
     try {
-      return new URL(decodeURI(url));
+      pathname = decodeURI(pathname);
     } catch {
-      return new URL(url);
     }
+    return {
+      hostname: parsed.hostname,
+      pathname,
+      protocol: parsed.protocol
+    };
   } else {
     throw new ParameterError("`url` argument is not a string or URL.");
   }
 }
 function checkSameSiteContext(value) {
-  const context = String(value).toLowerCase();
+  const context = value.toLowerCase();
   if (context === "none" || context === "lax" || context === "strict") {
     return context;
   } else {
@@ -1410,7 +1445,7 @@ function isSecurePrefixConditionMet(cookie) {
 function isHostPrefixConditionMet(cookie) {
   const startsWithHostPrefix = typeof cookie.key === "string" && cookie.key.startsWith("__Host-");
   return !startsWithHostPrefix || Boolean(
-    cookie.secure && cookie.hostOnly && cookie.path != null && cookie.path === "/"
+    cookie.secure && cookie.hostOnly && cookie.path != null && cookie.path === "/" && !cookie.pathIsDefault
   );
 }
 function getNormalizedPrefixSecurity(prefixSecurity) {
@@ -1443,6 +1478,7 @@ var CookieJar = class _CookieJar {
     this.enableLooseMode = options?.looseMode ?? false;
     this.allowSpecialUseDomain = options?.allowSpecialUseDomain ?? true;
     this.allowSecureOnLocal = options?.allowSecureOnLocal ?? true;
+    this.enforceSecureOriginOnStorage = options?.enforceSecureOriginOnStorage ?? true;
     this.prefixSecurity = getNormalizedPrefixSecurity(
       options?.prefixSecurity ?? "silent"
     );
@@ -1530,7 +1566,7 @@ var CookieJar = class _CookieJar {
           allowSpecialUseDomain: this.allowSpecialUseDomain,
           ignoreError: options?.ignoreError
         }) : null;
-        if (suffix == null && !IP_V6_REGEX_OBJECT.test(cookie.domain)) {
+        if (suffix == null && !IP_V4_REGEX_OBJECT.test(cdomain ?? "") && !IP_V6_REGEX_OBJECT.test(cdomain ?? "")) {
           const err = new Error("Cookie has domain set to a public suffix");
           return options?.ignoreError ? promiseCallback.resolve(void 0) : promiseCallback.reject(err);
         }
@@ -1559,6 +1595,12 @@ var CookieJar = class _CookieJar {
       cookie.path = defaultPath(context.pathname);
       cookie.pathIsDefault = true;
     }
+    if (this.enforceSecureOriginOnStorage && cookie.secure && !isPotentiallyTrustworthy(url, this.allowSecureOnLocal)) {
+      const err = new Error(
+        "Cookie is Secure but this is not a secure connection"
+      );
+      return options?.ignoreError ? promiseCallback.resolve(void 0) : promiseCallback.reject(err);
+    }
     if (options?.http === false && cookie.httpOnly) {
       const err = new Error("Cookie is HttpOnly and this isn't an HTTP API");
       return options.ignoreError ? promiseCallback.resolve(void 0) : promiseCallback.reject(err);
@@ -1883,6 +1925,7 @@ var CookieJar = class _CookieJar {
       rejectPublicSuffixes: this.rejectPublicSuffixes,
       enableLooseMode: this.enableLooseMode,
       allowSpecialUseDomain: this.allowSpecialUseDomain,
+      enforceSecureOriginOnStorage: this.enforceSecureOriginOnStorage,
       prefixSecurity: getNormalizedPrefixSecurity(this.prefixSecurity),
       // this gets filled from getAllCookies:
       cookies: []
@@ -2129,6 +2172,9 @@ var CookieJar = class _CookieJar {
       rejectPublicSuffixes: readSerializedBoolean("rejectPublicSuffixes"),
       looseMode: readSerializedBoolean("enableLooseMode"),
       allowSpecialUseDomain: readSerializedBoolean("allowSpecialUseDomain"),
+      enforceSecureOriginOnStorage: readSerializedBoolean(
+        "enforceSecureOriginOnStorage"
+      ),
       prefixSecurity: getNormalizedPrefixSecurity(
         readSerializedString("prefixSecurity") ?? "silent"
       )
@@ -2174,6 +2220,9 @@ var CookieJar = class _CookieJar {
       rejectPublicSuffixes: readSerializedBoolean("rejectPublicSuffixes"),
       looseMode: readSerializedBoolean("enableLooseMode"),
       allowSpecialUseDomain: readSerializedBoolean("allowSpecialUseDomain"),
+      enforceSecureOriginOnStorage: readSerializedBoolean(
+        "enforceSecureOriginOnStorage"
+      ),
       prefixSecurity: getNormalizedPrefixSecurity(
         readSerializedString("prefixSecurity") ?? "silent"
       )