Issue #3012 Compliance modes.

CookieCompliance implemented new APIs Signed-off-by: Greg Wilkins <gregw@webtide.com>
jetty · Mar 12, 2019 · 925d38b · 925d38b
1 parent 6baa4a9
commit 925d38b
Show file tree

Hide file tree

Showing 2 changed files with 96 additions and 5 deletions.
diff --git a/jetty-http/src/main/java/org/eclipse/jetty/http/CookieCompliance.java b/jetty-http/src/main/java/org/eclipse/jetty/http/CookieCompliance.java
@@ -18,8 +18,89 @@
 
 package org.eclipse.jetty.http;
 
+import java.util.EnumSet;
+import java.util.Objects;
+import java.util.Set;
+
+import static java.util.Collections.unmodifiableSet;
+import static java.util.EnumSet.allOf;
+import static java.util.EnumSet.copyOf;
+import static java.util.EnumSet.noneOf;
+
 /**
  * The compliance for Cookie handling.
  *
  */
-public enum CookieCompliance { RFC6265, RFC2965 }
+public class CookieCompliance implements ComplianceViolation.Mode
+{
+
+    enum Violation implements ComplianceViolation
+    {
+        COMMA_NOT_VALID_OCTET("https://tools.ietf.org/html/rfc6265#section-4.1.1", "Comma not valid as cookie-octet or separator"),
+        RESERVED_NAMES_NOT_DOLLAR_PREFIXED("https://tools.ietf.org/html/rfc6265#section-4.1.1","Reserved names no longer use '$' prefix")
+        ;
+
+        private final String url;
+        private final String description;
+
+        Violation(String url, String description)
+        {
+            this.url = url;
+            this.description = description;
+        }
+
+        @Override
+        public String getName()
+        {
+            return name();
+        }
+        @Override
+        public String getURL()
+        {
+            return null;
+        }
+
+        @Override
+        public String getDescription()
+        {
+            return null;
+        }
+    }
+
+    public static final CookieCompliance RFC6265 = new CookieCompliance("RFC6265", noneOf(Violation.class));
+    public static final CookieCompliance RFC2965 = new CookieCompliance("RFC2965", allOf(Violation.class));
+
+    private final String _name;
+    private final Set<Violation> _violations;
+
+    private CookieCompliance(String name, Set<Violation> violations)
+    {
+        Objects.nonNull(violations);
+        _name = name;
+        _violations = unmodifiableSet(copyOf(violations));
+    }
+
+    @Override
+    public boolean allows(ComplianceViolation violation)
+    {
+        return _violations.contains(violation);
+    }
+
+    @Override
+    public String getName()
+    {
+        return _name;
+    }
+
+    @Override
+    public Set<Violation> getKnown()
+    {
+        return EnumSet.allOf(Violation.class);
+    }
+
+    @Override
+    public Set<Violation> getAllowed()
+    {
+        return _violations;
+    }
+}
diff --git a/jetty-http/src/main/java/org/eclipse/jetty/http/CookieCutter.java b/jetty-http/src/main/java/org/eclipse/jetty/http/CookieCutter.java
@@ -24,17 +24,20 @@
 import org.eclipse.jetty.util.log.Log;
 import org.eclipse.jetty.util.log.Logger;
 
+import static org.eclipse.jetty.http.CookieCompliance.Violation.COMMA_NOT_VALID_OCTET;
+import static org.eclipse.jetty.http.CookieCompliance.Violation.RESERVED_NAMES_NOT_DOLLAR_PREFIXED;
+
 /** Cookie parser
  */
 public abstract class CookieCutter
 {
     protected static final Logger LOG = Log.getLogger(CookieCutter.class);
 
-    protected final CookieCompliance _compliance;
+    protected final CookieCompliance _complianceMode;
 
     protected CookieCutter(CookieCompliance compliance)
     {
-        _compliance = compliance;
+        _complianceMode = compliance;
     }
 
     protected void parseFields(List<String> rawFields)
@@ -121,7 +124,9 @@ protected void parseFields(List<String> rawFields)
                                 break;
 
                             case ',':
-                                if (_compliance!=CookieCompliance.RFC2965)
+                                if (COMMA_NOT_VALID_OCTET.isAllowedBy(_complianceMode))
+                                    reportComplianceViolation(COMMA_NOT_VALID_OCTET, "Cookie "+cookieName);
+                                else
                                 {
                                     if (quoted)
                                     {
@@ -157,8 +162,9 @@ else if(tokenstart>=0)
                                 {
                                     if (name.startsWith("$"))
                                     {
-                                        if (_compliance==CookieCompliance.RFC2965)
+                                        if (RESERVED_NAMES_NOT_DOLLAR_PREFIXED.isAllowedBy(_complianceMode))
                                         {
+                                            reportComplianceViolation(RESERVED_NAMES_NOT_DOLLAR_PREFIXED, "Cookie "+cookieName+" field "+name);
                                             String lowercaseName = name.toLowerCase(Locale.ENGLISH);
                                             switch(lowercaseName)
                                             {
@@ -277,6 +283,10 @@ else if(tokenstart>=0)
         }
     }
 
+    protected void reportComplianceViolation(CookieCompliance.Violation violation, String reason)
+    {
+    }
+
     protected abstract void addCookie(String cookieName, String cookieValue, String cookieDomain, String cookiePath, int cookieVersion, String cookieComment);