romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-05 17:26:13 +03:00
Code Issues Projects Releases Packages Wiki Activity

cookie: cap expire times to 400 days

Browse source 
The pending cookie RFC update (currently known as 6265bis draft-19) says

  Let cookie-age-limit be the maximum age of the cookie (which name of
  Max-Age and an attribute-value of expiry-time. SHOULD be 400 days or
  less.

This change makes received cookies over the wire get capped to 400 days.

It does not cap the expiry date of cookies loaded from file.

It does this by rounding the expire time to a even minute. This, to
allow the test suite to do the same and have a chance to get the same
number for stable testing without requiring a debug build.

The test script generates TWO numbers in the output file for each
%days[] used in the input test file, and the function that subsequently
compares and verifies output is fine with *either* of the two numbers.

This is done so that if the test case is generated the second
immediately before curl runs, that updated expiry number is also deemed
okay. It still checks for an exact match of either number.

Closes #15937
This commit is contained in:
Daniel Stenberg 2025-01-08 10:19:26 +01:00
parent 533dc84e6e
commit 386f570df6
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
10 changed files with 103 additions and 46 deletions
Download patch file Download diff file Expand all files Collapse all files

22
lib/cookie.c
View file

@ -97,6 +97,26 @@ Example set of cookies:
static void strstore(char **str, const char *newstr, size_t len);
/* number of seconds in 400 days */
#define COOKIES_MAXAGE (400*24*3600)
/* Make sure cookies never expire further away in time than 400 days into the
future. (from RFC6265bis draft-19)
For the sake of easier testing, align the capped time to an even 60 second
boundary.
*/
static void cap_expires(time_t now, struct Cookie *co)
{
if((TIME_T_MAX - COOKIES_MAXAGE - 30) > now) {
timediff_t cap = now + COOKIES_MAXAGE;
if(co->expires > cap) {
cap += 30;
co->expires = (cap/60)*60;
}
}
}
static void freecookie(struct Cookie *co)
{
free(co->domain);
@ -714,6 +734,7 @@ parse_cookie_header(struct Curl_easy *data,
co->expires += now;
break;
}
cap_expires(now, co);
}
else if((nlen == 7) && strncasecompare("expires", namep, 7)) {
if(!co->expires && (vlen < MAX_DATE_LENGTH)) {
@ -737,6 +758,7 @@ parse_cookie_header(struct Curl_easy *data,
co->expires = 1;
else if(co->expires < 0)
co->expires = 0;
cap_expires(now, co);
}
}