webget-cli 0.16.0__tar.gz → 0.16.1__tar.gz

{webget_cli-0.16.0/webget_cli.egg-info → webget_cli-0.16.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: webget-cli
-Version: 0.16.0
+Version: 0.16.1
 Summary: Local search + scrape CLI with an HTTP fast path, optional browser fallback, and authenticated session profiles. Zero API keys.
 Author-email: David Tarigan <tarigansdavid@gmail.com>
 License-Expression: Apache-2.0

{webget_cli-0.16.0 → webget_cli-0.16.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "webget-cli"
-version = "0.16.0"
+version = "0.16.1"
 description = "Local search + scrape CLI with an HTTP fast path, optional browser fallback, and authenticated session profiles. Zero API keys."
 readme = "README.md"
 requires-python = ">=3.11"

{webget_cli-0.16.0 → webget_cli-0.16.1}/tests/test_adversarial_auth.py

@@ -128,6 +128,26 @@ class TestSessionReuse:
         res = asyncio.run(_fetch(server.url("/cookie-gated"), cookies=ck))
         assert _one(res)["status"] == "success"
 
+    def test_epoch_zero_cookie_is_expired_not_session(self, fresh_cache, isolated_env):
+        """expires == 0 is an already-expired cookie (epoch 1970), not a session.
+
+        The old jar build used ``expires or -1``, which turned an explicit 0
+        into -1 and made the cookie look like a non-expiring session cookie, so
+        an expired cookie was still sent. Session cookies are represented by a
+        missing expires or -1 (see profile.py), never by 0.
+        """
+        server = fresh_cache
+        ck = [_cookie("session", server.host, expires=0)]
+        res = asyncio.run(_fetch(server.url("/cookie-gated"), cookies=ck))
+        assert _one(res)["status"] == "blocked"
+
+    def test_absent_expiry_is_a_session_cookie(self, fresh_cache, isolated_env):
+        """A cookie with no `expires` key is a session cookie and IS sent."""
+        server = fresh_cache
+        ck = [{"name": "session", "value": "v", "domain": server.host, "path": "/"}]
+        res = asyncio.run(_fetch(server.url("/cookie-gated"), cookies=ck))
+        assert _one(res)["status"] == "success"
+
 
 class TestProfileMeta:
     def test_corrupt_state_reports_corrupt(self, isolated_env):

{webget_cli-0.16.0 → webget_cli-0.16.1}/tests/test_webget.py

@@ -49,6 +49,29 @@ class TestParseOpts:
         assert r2 == ["u", "https://x.com"]
         assert c2 is not None
 
+    def test_cookies_httponly_prefix_is_parsed(self, tmp_path):
+        """Netscape HttpOnly lines start with '#HttpOnly_' and must be parsed.
+
+        The parser skips any line starting with '#', so without stripping the
+        prefix those cookies would be silently dropped.
+        """
+        ck = tmp_path / "ck.txt"
+        ck.write_text(
+            "# Netscape HTTP Cookie File\n"
+            "#HttpOnly_.x.com\tTRUE\t/\tFALSE\t0\ts\tv\n"
+        )
+        _, c1, *_ = opts("-c", str(ck), "u", "https://x.com")
+        assert c1 is not None and len(c1) == 1
+        assert c1[0]["name"] == "s" and c1[0]["httpOnly"] is True
+        # a real comment line is still ignored
+        ck.write_text(
+            "# Netscape HTTP Cookie File\n"
+            "# a comment\n"
+            "#HttpOnly_.x.com\tTRUE\t/\tFALSE\t0\ts\tv\n"
+        )
+        _, c2, *_ = opts("-c", str(ck), "u", "https://x.com")
+        assert c2 is not None and len(c2) == 1 and c2[0]["httpOnly"] is True
+
     def test_max_chars_aliases(self):
         _, _, _, mc1, *_ = opts("-n", "500", "u", "https://x.com")
         _, _, _, mc2, *_ = opts("--max-chars", "500", "u", "https://x.com")

{webget_cli-0.16.0 → webget_cli-0.16.1}/webget/cache.py

@@ -58,6 +58,9 @@ def parse_cookie_file(path):
     with open(os.path.expanduser(path)) as f:
         for line in f:
             line = line.strip()
+            http_only = line.startswith("#HttpOnly_")
+            if http_only:
+                line = line[len("#HttpOnly_") :]
             if not line or line.startswith("#"):
                 continue
             parts = line.split("\t")
@@ -70,7 +73,7 @@ def parse_cookie_file(path):
                 "domain": domain,
                 "path": path_,
                 "secure": secure == "TRUE",
-                "httpOnly": False,
+                "httpOnly": http_only,
             }
             if expires not in ("0", "Session", ""):
                 try:

{webget_cli-0.16.0 → webget_cli-0.16.1}/webget/http.py

@@ -336,7 +336,8 @@ async def fetch_http(url, max_chars, cookies=None, headers=None, timeout=15):
             for c in cookies:
                 d = (c.get("domain") or "").lstrip(".").lower()
                 if d and (host == d or host.endswith("." + d)):
-                    exp = c.get("expires") or -1
+                    exp = c.get("expires")
+                    exp = -1 if exp is None else exp
                     # Skip expired cookies: session cookies (expires<0) and
                     # future-expiry cookies are sent; past-expiry are not.
                     if 0 <= exp < now:

{webget_cli-0.16.0 → webget_cli-0.16.1/webget_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: webget-cli
-Version: 0.16.0
+Version: 0.16.1
 Summary: Local search + scrape CLI with an HTTP fast path, optional browser fallback, and authenticated session profiles. Zero API keys.
 Author-email: David Tarigan <tarigansdavid@gmail.com>
 License-Expression: Apache-2.0