tough-cookie 6.0.1 → 6.1.0

package/dist/index.js

@@ -384,7 +384,7 @@ var ParameterError = class extends Error {
 };
 
 // lib/version.ts
-var version = "6.0.1";
+var version = "6.1.0";
 
 // lib/cookie/constants.ts
 var PrefixSecurityEnum = {
@@ -438,6 +438,17 @@ function formatDate(date) {
   return date.toUTCString();
 }
 
+// lib/cookie/cookieName.ts
+var INVALID_TOKEN_CHARACTER = /[^\x21\x23-\x27\x2A\x2B\x2D\x2E\x30-\x39\x41-\x5A\x5E-\x7A\x7C\x7E]/;
+var CookieName = {
+  parse(input) {
+    if (input.length === 0 || INVALID_TOKEN_CHARACTER.test(input)) {
+      return void 0;
+    }
+    return input;
+  }
+};
+
 // lib/cookie/parseDate.ts
 function parseDate(cookieDate) {
   if (!cookieDate) {
@@ -612,8 +623,8 @@ function parse(str, options) {
     return c;
   }
   const cookie_avs = unparsed.split(";");
-  while (cookie_avs.length) {
-    const av = (cookie_avs.shift() ?? "").trim();
+  for (const cookie_av of cookie_avs) {
+    const av = cookie_av.trim();
     if (av.length === 0) {
       continue;
     }
@@ -896,10 +907,17 @@ var _Cookie = class _Cookie {
    *
    * @remarks
    * Works for a few things, but is by no means comprehensive.
+   * Checks that the cookie name is a non-empty token as defined in RFC 6265 Section 4.1.1.
+   * Nameless cookies (including those parsed in loose mode or created with `new Cookie({ value })`)
+   * and names containing characters outside the token grammar (such as `a b`) return `false`.
+   * Parsing and storage remain permissive; this check only applies to explicit validation.
    *
    * @beta
    */
   validate() {
+    if (CookieName.parse(this.key) === void 0) {
+      return false;
+    }
     if (!this.value || !COOKIE_OCTETS.test(this.value)) {
       return false;
     }
@@ -918,7 +936,7 @@ var _Cookie = class _Cookie {
         return false;
       }
       const suffix = getPublicSuffix(cdomain);
-      if (suffix == null) {
+      if (suffix == null && !IP_V4_REGEX_OBJECT.test(cdomain) && !IP_V6_REGEX_OBJECT.test(cdomain)) {
         return false;
       }
     }
@@ -994,11 +1012,13 @@ var _Cookie = class _Cookie {
     if (this.httpOnly) {
       str += "; HttpOnly";
     }
-    if (this.sameSite && this.sameSite !== "none") {
+    if (this.sameSite) {
       if (this.sameSite.toLowerCase() === _Cookie.sameSiteCanonical.lax.toLowerCase()) {
         str += `; SameSite=${_Cookie.sameSiteCanonical.lax}`;
       } else if (this.sameSite.toLowerCase() === _Cookie.sameSiteCanonical.strict.toLowerCase()) {
         str += `; SameSite=${_Cookie.sameSiteCanonical.strict}`;
+      } else if (this.sameSite.toLowerCase() === _Cookie.sameSiteCanonical.none.toLowerCase()) {
+        str += `; SameSite=${_Cookie.sameSiteCanonical.none}`;
       } else {
         str += `; SameSite=${this.sameSite}`;
       }
@@ -1045,6 +1065,9 @@ var _Cookie = class _Cookie {
    */
   expiryTime(now) {
     if (this.maxAge != null) {
+      if (this.maxAge === "Infinity") {
+        return Infinity;
+      }
       const relativeTo = now || this.lastAccessed || /* @__PURE__ */ new Date();
       const maxAge = typeof this.maxAge === "number" ? this.maxAge : -Infinity;
       const age = maxAge <= 0 ? -Infinity : maxAge * 1e3;
@@ -1177,7 +1200,8 @@ _Cookie.sameSiteLevel = {
  */
 _Cookie.sameSiteCanonical = {
   strict: "Strict",
-  lax: "Lax"
+  lax: "Lax",
+  none: "None"
 };
 /**
  * Cookie properties that will be serialized when using {@link Cookie.fromJSON} and {@link Cookie.toJSON}.
@@ -1336,23 +1360,34 @@ var defaultGetCookieOptions = {
 var SAME_SITE_CONTEXT_VAL_ERR = 'Invalid sameSiteContext option for getCookies(); expected one of "strict", "lax", or "none"';
 function getCookieContext(url) {
   if (url && typeof url === "object" && "hostname" in url && typeof url.hostname === "string" && "pathname" in url && typeof url.pathname === "string" && "protocol" in url && typeof url.protocol === "string") {
+    let pathname = url.pathname;
+    try {
+      pathname = decodeURI(pathname);
+    } catch {
+    }
     return {
       hostname: url.hostname,
-      pathname: url.pathname,
+      pathname,
       protocol: url.protocol
     };
   } else if (typeof url === "string") {
+    const parsed = new URL(url);
+    let pathname = parsed.pathname;
     try {
-      return new URL(decodeURI(url));
+      pathname = decodeURI(pathname);
     } catch {
-      return new URL(url);
     }
+    return {
+      hostname: parsed.hostname,
+      pathname,
+      protocol: parsed.protocol
+    };
   } else {
     throw new ParameterError("`url` argument is not a string or URL.");
   }
 }
 function checkSameSiteContext(value) {
-  const context = String(value).toLowerCase();
+  const context = value.toLowerCase();
   if (context === "none" || context === "lax" || context === "strict") {
     return context;
   } else {
@@ -1366,7 +1401,7 @@ function isSecurePrefixConditionMet(cookie) {
 function isHostPrefixConditionMet(cookie) {
   const startsWithHostPrefix = typeof cookie.key === "string" && cookie.key.startsWith("__Host-");
   return !startsWithHostPrefix || Boolean(
-    cookie.secure && cookie.hostOnly && cookie.path != null && cookie.path === "/"
+    cookie.secure && cookie.hostOnly && cookie.path != null && cookie.path === "/" && !cookie.pathIsDefault
   );
 }
 function getNormalizedPrefixSecurity(prefixSecurity) {
@@ -1399,6 +1434,7 @@ var CookieJar = class _CookieJar {
     this.enableLooseMode = options?.looseMode ?? false;
     this.allowSpecialUseDomain = options?.allowSpecialUseDomain ?? true;
     this.allowSecureOnLocal = options?.allowSecureOnLocal ?? true;
+    this.enforceSecureOriginOnStorage = options?.enforceSecureOriginOnStorage ?? true;
     this.prefixSecurity = getNormalizedPrefixSecurity(
       options?.prefixSecurity ?? "silent"
     );
@@ -1486,7 +1522,7 @@ var CookieJar = class _CookieJar {
           allowSpecialUseDomain: this.allowSpecialUseDomain,
           ignoreError: options?.ignoreError
         }) : null;
-        if (suffix == null && !IP_V6_REGEX_OBJECT.test(cookie.domain)) {
+        if (suffix == null && !IP_V4_REGEX_OBJECT.test(cdomain ?? "") && !IP_V6_REGEX_OBJECT.test(cdomain ?? "")) {
           const err = new Error("Cookie has domain set to a public suffix");
           return options?.ignoreError ? promiseCallback.resolve(void 0) : promiseCallback.reject(err);
         }
@@ -1515,6 +1551,12 @@ var CookieJar = class _CookieJar {
       cookie.path = defaultPath(context.pathname);
       cookie.pathIsDefault = true;
     }
+    if (this.enforceSecureOriginOnStorage && cookie.secure && !isPotentiallyTrustworthy(url, this.allowSecureOnLocal)) {
+      const err = new Error(
+        "Cookie is Secure but this is not a secure connection"
+      );
+      return options?.ignoreError ? promiseCallback.resolve(void 0) : promiseCallback.reject(err);
+    }
     if (options?.http === false && cookie.httpOnly) {
       const err = new Error("Cookie is HttpOnly and this isn't an HTTP API");
       return options.ignoreError ? promiseCallback.resolve(void 0) : promiseCallback.reject(err);
@@ -1839,6 +1881,7 @@ var CookieJar = class _CookieJar {
       rejectPublicSuffixes: this.rejectPublicSuffixes,
       enableLooseMode: this.enableLooseMode,
       allowSpecialUseDomain: this.allowSpecialUseDomain,
+      enforceSecureOriginOnStorage: this.enforceSecureOriginOnStorage,
       prefixSecurity: getNormalizedPrefixSecurity(this.prefixSecurity),
       // this gets filled from getAllCookies:
       cookies: []
@@ -2085,6 +2128,9 @@ var CookieJar = class _CookieJar {
       rejectPublicSuffixes: readSerializedBoolean("rejectPublicSuffixes"),
       looseMode: readSerializedBoolean("enableLooseMode"),
       allowSpecialUseDomain: readSerializedBoolean("allowSpecialUseDomain"),
+      enforceSecureOriginOnStorage: readSerializedBoolean(
+        "enforceSecureOriginOnStorage"
+      ),
       prefixSecurity: getNormalizedPrefixSecurity(
         readSerializedString("prefixSecurity") ?? "silent"
       )
@@ -2130,6 +2176,9 @@ var CookieJar = class _CookieJar {
       rejectPublicSuffixes: readSerializedBoolean("rejectPublicSuffixes"),
       looseMode: readSerializedBoolean("enableLooseMode"),
       allowSpecialUseDomain: readSerializedBoolean("allowSpecialUseDomain"),
+      enforceSecureOriginOnStorage: readSerializedBoolean(
+        "enforceSecureOriginOnStorage"
+      ),
       prefixSecurity: getNormalizedPrefixSecurity(
         readSerializedString("prefixSecurity") ?? "silent"
       )