Skip to content

Commit 96de11f

Browse files
gregwgregw
committed
Merge remote-tracking branch 'origin/jetty-10.0.x' into jetty-11.0.x
Signed-off-by: gregw <[email protected]>
2 parents d175f32 + 4d14641 commit 96de11f

File tree

10 files changed

+523
-90
lines changed

10 files changed

+523
-90
lines changed

‎jetty-http/src/main/java/org/eclipse/jetty/http/CookieCompliance.java‎

Lines changed: 43 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -128,13 +128,12 @@ public String getDescription()
128128
* <p>A CookieCompliance mode that enforces <a href="https://tools.ietf.org/html/rfc6265">RFC 6265</a> compliance,
129129
* but allows:</p>
130130
* <ul>
131-
* <li>{@link Violation#ATTRIBUTES}</li>
132131
* <li>{@link Violation#INVALID_COOKIES}</li>
133132
* <li>{@link Violation#OPTIONAL_WHITE_SPACE}</li>
134133
* </ul>
135134
*/
136135
public static final CookieCompliance RFC6265 = new CookieCompliance("RFC6265", of(
137-
Violation.ATTRIBUTES, Violation.INVALID_COOKIES, Violation.OPTIONAL_WHITE_SPACE)
136+
Violation.INVALID_COOKIES, Violation.OPTIONAL_WHITE_SPACE)
138137
);
139138

140139
/**
@@ -146,15 +145,16 @@ public String getDescription()
146145
* <p>A CookieCompliance mode that enforces <a href="https://tools.ietf.org/html/rfc6265">RFC 6265</a> compliance,
147146
* but allows:</p>
148147
* <ul>
148+
* <li>{@link Violation#ATTRIBUTES}</li>
149149
* <li>{@link Violation#BAD_QUOTES}</li>
150150
* <li>{@link Violation#ESCAPE_IN_QUOTES}</li>
151151
* <li>{@link Violation#INVALID_COOKIES}</li>
152152
* <li>{@link Violation#OPTIONAL_WHITE_SPACE}</li>
153153
* <li>{@link Violation#SPECIAL_CHARS_IN_QUOTES}</li>
154154
* </ul>
155155
*/
156-
public static final CookieCompliance RFC6265_LEGACY = new CookieCompliance("RFC6265_LEGACY", of(
157-
Violation.BAD_QUOTES, Violation.ESCAPE_IN_QUOTES, Violation.INVALID_COOKIES, Violation.OPTIONAL_WHITE_SPACE, Violation.SPECIAL_CHARS_IN_QUOTES)
156+
public static final CookieCompliance RFC6265_LEGACY = new CookieCompliance("RFC6265_LEGACY", EnumSet.of(
157+
Violation.ATTRIBUTES, Violation.BAD_QUOTES, Violation.ESCAPE_IN_QUOTES, Violation.INVALID_COOKIES, Violation.OPTIONAL_WHITE_SPACE, Violation.SPECIAL_CHARS_IN_QUOTES)
158158
);
159159

160160
/**
@@ -214,40 +214,45 @@ public static CookieCompliance valueOf(String name)
214214
*/
215215
public static CookieCompliance from(String spec)
216216
{
217-
Set<Violation> violations;
218-
String[] elements = spec.split("\\s*,\\s*");
219-
switch (elements[0])
217+
CookieCompliance compliance = valueOf(spec);
218+
if (compliance == null)
220219
{
221-
case "0":
222-
violations = noneOf(Violation.class);
223-
break;
224-
225-
case "*":
226-
violations = allOf(Violation.class);
227-
break;
220+
String[] elements = spec.split("\\s*,\\s*");
221+
Set<Violation> violations;
222+
switch (elements[0])
223+
{
224+
case "0" :
225+
violations = noneOf(Violation.class);
226+
break;
227+
228+
case "*" :
229+
violations = allOf(Violation.class);
230+
break;
231+
232+
default :
233+
{
234+
CookieCompliance mode = valueOf(elements[0]);
235+
if (mode == null)
236+
throw new IllegalArgumentException("Unknown base mode: " + elements[0]);
237+
violations = (mode.getAllowed().isEmpty()) ? noneOf(Violation.class) : copyOf(mode.getAllowed());
238+
}
239+
}
228240

229-
default:
241+
for (int i = 1; i < elements.length; i++)
230242
{
231-
CookieCompliance mode = valueOf(elements[0]);
232-
violations = (mode == null) ? noneOf(Violation.class) : copyOf(mode.getAllowed());
233-
break;
243+
String element = elements[i];
244+
boolean exclude = element.startsWith("-");
245+
if (exclude)
246+
element = element.substring(1);
247+
Violation section = Violation.valueOf(element);
248+
if (exclude)
249+
violations.remove(section);
250+
else
251+
violations.add(section);
234252
}
235-
}
236253

237-
for (int i = 1; i < elements.length; i++)
238-
{
239-
String element = elements[i];
240-
boolean exclude = element.startsWith("-");
241-
if (exclude)
242-
element = element.substring(1);
243-
Violation section = Violation.valueOf(element);
244-
if (exclude)
245-
violations.remove(section);
246-
else
247-
violations.add(section);
254+
compliance = new CookieCompliance("CUSTOM" + __custom.getAndIncrement(), violations);
248255
}
249-
250-
CookieCompliance compliance = new CookieCompliance("CUSTOM" + __custom.getAndIncrement(), violations);
251256
if (LOG.isDebugEnabled())
252257
LOG.debug("CookieCompliance from {}->{}", spec, compliance);
253258
return compliance;
@@ -290,4 +295,10 @@ public boolean compliesWith(CookieCompliance mode)
290295
{
291296
return this == mode || getAllowed().containsAll(mode.getAllowed());
292297
}
298+
299+
@Override
300+
public String toString()
301+
{
302+
return String.format("%s@%x%s", _name, hashCode(), _violations);
303+
}
293304
}

‎jetty-http/src/main/java/org/eclipse/jetty/http/CookieParser.java‎

Lines changed: 28 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -41,9 +41,9 @@ static CookieParser newParser(Handler handler, CookieCompliance compliance, List
4141
return new RFC6265CookieParser(handler, compliance, complianceListener);
4242
}
4343

44-
void parseField(String field);
44+
void parseField(String field) throws InvalidCookieException;
4545

46-
default void parseFields(List<String> rawFields)
46+
default void parseFields(List<String> rawFields) throws InvalidCookieException
4747
{
4848
// For each cookie field
4949
for (String field : rawFields)
@@ -57,4 +57,30 @@ interface Handler
5757
{
5858
void addCookie(String name, String value, int version, String domain, String path, String comment);
5959
}
60+
61+
/**
62+
* <p>The exception thrown when a cookie cannot be parsed and {@link CookieCompliance.Violation#INVALID_COOKIES} is not allowed.</p>
63+
*/
64+
class InvalidCookieException extends IllegalArgumentException
65+
{
66+
public InvalidCookieException()
67+
{
68+
super();
69+
}
70+
71+
public InvalidCookieException(String s)
72+
{
73+
super(s);
74+
}
75+
76+
public InvalidCookieException(String message, Throwable cause)
77+
{
78+
super(message, cause);
79+
}
80+
81+
public InvalidCookieException(Throwable cause)
82+
{
83+
super(cause);
84+
}
85+
}
6086
}

‎jetty-http/src/main/java/org/eclipse/jetty/http/HttpCookie.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -281,7 +281,7 @@ private static boolean isQuoteNeededForCookie(String s)
281281

282282
public String getSetCookie(CookieCompliance compliance)
283283
{
284-
if (CookieCompliance.RFC6265.compliesWith(compliance))
284+
if (compliance == null || CookieCompliance.RFC6265_LEGACY.compliesWith(compliance))
285285
return getRFC6265SetCookie();
286286
return getRFC2965SetCookie();
287287
}

‎jetty-http/src/main/java/org/eclipse/jetty/http/RFC6265CookieParser.java‎

Lines changed: 17 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -85,7 +85,7 @@ public void parseField(String field)
8585
if (token == null)
8686
{
8787
if (!_complianceMode.allows(INVALID_COOKIES))
88-
throw new IllegalArgumentException("Invalid Cookie character");
88+
throw new InvalidCookieException("Invalid Cookie character");
8989
state = State.INVALID_COOKIE;
9090
continue;
9191
}
@@ -100,7 +100,7 @@ public void parseField(String field)
100100

101101
if (token.isRfc2616Token())
102102
{
103-
if (!StringUtil.isBlank(cookieName) && c != '$')
103+
if (!StringUtil.isBlank(cookieName) && !(c == '$' && (_complianceMode.allows(ATTRIBUTES) || _complianceMode.allows(ATTRIBUTE_VALUES))))
104104
{
105105
_handler.addCookie(cookieName, cookieValue, cookieVersion, cookieDomain, cookiePath, cookieComment);
106106
cookieName = null;
@@ -120,7 +120,7 @@ else if (_complianceMode.allows(INVALID_COOKIES))
120120
}
121121
else
122122
{
123-
throw new IllegalArgumentException("Bad Cookie name");
123+
throw new InvalidCookieException("Bad Cookie name");
124124
}
125125

126126
break;
@@ -158,7 +158,7 @@ else if (_complianceMode.allows(INVALID_COOKIES))
158158
}
159159
else
160160
{
161-
throw new IllegalArgumentException("Bad Cookie name");
161+
throw new InvalidCookieException("Bad Cookie name");
162162
}
163163
break;
164164

@@ -181,7 +181,7 @@ else if (_complianceMode.allows(INVALID_COOKIES))
181181
}
182182
else
183183
{
184-
throw new IllegalArgumentException("Bad Cookie");
184+
throw new InvalidCookieException("Bad Cookie");
185185
}
186186
break;
187187

@@ -215,7 +215,7 @@ else if (_complianceMode.allows(INVALID_COOKIES))
215215
}
216216
else
217217
{
218-
throw new IllegalArgumentException("Bad Cookie value");
218+
throw new InvalidCookieException("Bad Cookie value");
219219
}
220220
break;
221221

@@ -237,7 +237,7 @@ else if (_complianceMode.allows(INVALID_COOKIES))
237237
}
238238
else
239239
{
240-
throw new IllegalArgumentException("Bad Cookie value");
240+
throw new InvalidCookieException("Bad Cookie value");
241241
}
242242
break;
243243

@@ -277,7 +277,7 @@ else if (_complianceMode.allows(INVALID_COOKIES))
277277
}
278278
else
279279
{
280-
throw new IllegalArgumentException("Bad Cookie quoted value");
280+
throw new InvalidCookieException("Bad Cookie quoted value");
281281
}
282282
break;
283283

@@ -299,7 +299,7 @@ else if (_complianceMode.allows(INVALID_COOKIES))
299299
}
300300
else
301301
{
302-
throw new IllegalArgumentException("Bad Cookie quoted value");
302+
throw new InvalidCookieException("Bad Cookie quoted value");
303303
}
304304
break;
305305

@@ -323,7 +323,7 @@ else if (_complianceMode.allows(INVALID_COOKIES))
323323
}
324324
else
325325
{
326-
throw new IllegalStateException("Comma cookie separator");
326+
throw new InvalidCookieException("Comma cookie separator");
327327
}
328328
}
329329
else if ((c == ' ' || c == '\t') && _complianceMode.allows(OPTIONAL_WHITE_SPACE))
@@ -332,7 +332,6 @@ else if ((c == ' ' || c == '\t') && _complianceMode.allows(OPTIONAL_WHITE_SPACE)
332332
continue;
333333
}
334334

335-
boolean knownAttribute = true;
336335
if (StringUtil.isBlank(attributeName))
337336
{
338337
cookieValue = value;
@@ -358,39 +357,28 @@ else if ((c == ' ' || c == '\t') && _complianceMode.allows(OPTIONAL_WHITE_SPACE)
358357
cookieVersion = Integer.parseInt(value);
359358
break;
360359
default:
361-
knownAttribute = false;
360+
if (!_complianceMode.allows(INVALID_COOKIES))
361+
throw new IllegalArgumentException("Invalid Cookie attribute");
362+
reportComplianceViolation(INVALID_COOKIES, field);
363+
state = State.INVALID_COOKIE;
362364
break;
363365
}
364366
}
365367
else if (_complianceMode.allows(ATTRIBUTES))
366368
{
367369
reportComplianceViolation(ATTRIBUTES, field);
368370
}
369-
else if (_complianceMode.allows(INVALID_COOKIES))
370-
{
371-
reportComplianceViolation(INVALID_COOKIES, field);
372-
state = State.INVALID_COOKIE;
373-
continue;
374-
}
375371
else
376372
{
377-
throw new IllegalArgumentException("Invalid Cookie with attributes");
373+
cookieName = attributeName;
374+
cookieValue = value;
378375
}
379376
attributeName = null;
380377
}
381378
value = null;
382379

383-
if (!knownAttribute)
384-
{
385-
if (!_complianceMode.allows(INVALID_COOKIES))
386-
throw new IllegalArgumentException("Invalid Cookie attribute");
387-
reportComplianceViolation(INVALID_COOKIES, field);
388-
state = State.INVALID_COOKIE;
389-
continue;
390-
}
391-
392380
if (state == State.END)
393-
throw new IllegalStateException("Invalid cookie");
381+
throw new InvalidCookieException("Invalid cookie");
394382
break;
395383

396384
case INVALID_COOKIE:

0 commit comments

Comments
 (0)