Prefix dot in domain for proper domain validation in cookiejar

tirkarthi · tirkarthi · commit ddd54adacb85 · 2018-12-24T16:18:33.000+05:30
diff --git a/Lib/cookielib.py b/Lib/cookielib.py
@@ -1161,11 +1161,14 @@ def domain_return_ok(self, domain, request):
         # Liberal check of.  This is here as an optimization to avoid
         # having to load lots of MSIE cookie files unless necessary.
         req_host, erhn = eff_request_host(request)
+        suffix_check_domain = domain
         if not req_host.startswith("."):
             req_host = "."+req_host
         if not erhn.startswith("."):
             erhn = "."+erhn
-        if not (req_host.endswith(domain) or erhn.endswith(domain)):
+        if suffix_check_domain and not suffix_check_domain.startswith("."):
+            suffix_check_domain = "." + suffix_check_domain
+        if not (req_host.endswith(suffix_check_domain) or erhn.endswith(suffix_check_domain)):
             #_debug("   request domain %s does not match cookie domain %s",
             #       req_host, domain)
             return False
diff --git a/Lib/test/test_cookielib.py b/Lib/test/test_cookielib.py
@@ -368,6 +368,7 @@ def test_domain_return_ok(self):
             ("http://foo.bar.com/", ".foo.bar.com", True),
             ("http://foo.bar.com/", "foo.bar.com", True),
             ("http://foo.bar.com/", ".bar.com", True),
+            ("http://foo.bar.com/", "bar.com", True),
             ("http://foo.bar.com/", "com", True),
             ("http://foo.com/", "rhubarb.foo.com", False),
             ("http://foo.com/", ".foo.com", True),
@@ -378,6 +379,8 @@ def test_domain_return_ok(self):
             ("http://foo/", "foo", True),
             ("http://foo/", "foo.local", True),
             ("http://foo/", ".local", True),
+            ("http://barfoo.com", ".foo.com", False),
+            ("http://barfoo.com", "foo.com", False),
             ]:
             request = urllib2.Request(url)
             r = pol.domain_return_ok(domain, request)
@@ -938,6 +941,31 @@ def test_domain_block(self):
         c.add_cookie_header(req)
         self.assertFalse(req.has_header("Cookie"))
 
+        c.clear()
+
+        pol.set_blocked_domains([])
+        req = Request("http://acme.com/")
+        res = FakeResponse(headers, "http://acme.com/")
+        c.extract_cookies(res, req)
+        self.assertEqual(len(c), 1)
+
+        req = Request("http://acme.com/")
+        c.add_cookie_header(req)
+        self.assertTrue(req.has_header("Cookie"))
+
+        req = Request("http://badacme.com/")
+        c.add_cookie_header(req)
+        self.assertFalse(req.has_header("Cookie"))
+
+        p = pol.set_blocked_domains(["acme.com"])
+        req = Request("http://acme.com/")
+        c.add_cookie_header(req)
+        self.assertFalse(req.has_header("Cookie"))
+
+        req = Request("http://badacme.com/")
+        c.add_cookie_header(req)
+        self.assertFalse(req.has_header("Cookie"))
+
     def test_secure(self):
         from cookielib import CookieJar, DefaultCookiePolicy
 
