cookies: extend domain checks to non psl builds

Ensure to perform the checks we have to enforce a sane domain in
the cookie request. The check for non-PSL enabled builds is quite
basic but it's better than nothing.

Closes #2964
Reviewed-by: Daniel Stenberg <daniel@haxx.se>

diff --git a/lib/cookie.c b/lib/cookie.c
index bc0ab0dfe383885432304af1eba7522dbb09e39f..f52c308401548c63050992bdda606a0f893274f5 100644 (file)
--- a/lib/cookie.c
+++ b/lib/cookie.c
@@ -803,6 +803,8 @@ Curl_cookie_add(struct Curl_easy *data,
         co->domain = strdup(ptr);
         if(!co->domain)
           badcookie = TRUE;
+        else if(bad_domain(co->domain))
+          badcookie = TRUE;
         break;
       case 1:
         /* This field got its explanation on the 23rd of May 2001 by
@@ -906,18 +908,20 @@ Curl_cookie_add(struct Curl_easy *data,
   if(!noexpire)
     remove_expired(c);
 
-#ifdef USE_LIBPSL
-  /* Check if the domain is a Public Suffix and if yes, ignore the cookie. */
   if(domain && co->domain && !isip(co->domain)) {
-    const psl_ctx_t *psl = Curl_psl_use(data);
     int acceptable;
+#ifdef USE_LIBPSL
+    const psl_ctx_t *psl = Curl_psl_use(data);
 
+    /* Check if the domain is a Public Suffix and if yes, ignore the cookie. */
     if(psl) {
       acceptable = psl_is_cookie_domain_acceptable(psl, domain, co->domain);
       Curl_psl_release(data);
     }
     else
-      acceptable = !bad_domain(domain);
+#endif
+    /* Without libpsl, do the best we can. */
+    acceptable = !bad_domain(co->domain);
 
     if(!acceptable) {
       infof(data, "cookie '%s' dropped, domain '%s' must not "
@@ -926,7 +930,6 @@ Curl_cookie_add(struct Curl_easy *data,
       return NULL;
     }
   }
-#endif
 
   myhash = cookiehash(co->domain);
   clist = c->cookies[myhash];

diff --git a/tests/data/test8 b/tests/data/test8
index 2fc19006097f8db5131a3a7bc7f2a236d121a373..e6d0f500e092aa03baa8e6ca48744441cb0d08f9 100644 (file)
--- a/tests/data/test8
+++ b/tests/data/test8
@@ -46,6 +46,7 @@ Set-Cookie: trailingspace    = removed; path=/we/want;
 Set-Cookie: nocookie=yes; path=/WE;
 Set-Cookie: blexp=yesyes; domain=%HOSTIP; domain=%HOSTIP; expiry=totally bad;
 Set-Cookie: partialip=nono; domain=.0.0.1;
+Set-Cookie: chocolate=chip; domain=curl; path=/we/want;
 
 </file>
 <precheck>