/* The string may contain several cookies separated by comma.    * We'll iterate until we've catched them all */   while (*str) {      cookie = Cookies_parse_one(set_url, &str);      if (cookie) {         ret = g_slist_append(ret, cookie);      } else {         DEBUG_MSG(8, "Malformed cookie field, ignoring cookie: %s\n",                   cookie_string);         return NULL;      }   }   return ret;}/* * Compare cookies by name and path (return 0 if equal) */static gint Cookies_equals(gconstpointer a, gconstpointer b){   const CookieData_t *ca = a, *cb = b;   return (strcmp(ca->name, cb->name) || strcmp(ca->path, cb->path));}/* * Validate cookies domain against some security checks. */static gboolean Cookies_validate_domain(CookieData_t *cookie,                                        const DilloUrl *set_url){   const char *host;   int dots, diff, i;   gboolean is_ip;   /* Make sure that the path is set to something */   if (!cookie->path || cookie->path[0] != '/') {      g_free(cookie->path);      cookie->path = Cookies_strip_path(URL_PATH_(set_url));   }   /* If the server never set a domain, or set one without a leading    * dot (which isn't allowed), we use the calling URL's hostname. */   if (cookie->domain == NULL || cookie->domain[0] != '.') {      g_free(cookie->domain);      cookie->domain = g_strdup(URL_HOST(set_url));      return TRUE;   }   /* Count the number of dots and also find out if it is an IP-address */   is_ip = TRUE;   for (i = 0, dots = 0; cookie->domain[i] != '\0'; i++) {      if (cookie->domain[i] == '.')         dots++;      else if (!isdigit(cookie->domain[i]))         is_ip = FALSE;   }   /* A valid domain must have at least two dots in it */   /* NOTE: this breaks cookies on localhost... */   if (dots < 2) {      return FALSE;   }   /* Now see if the url matches the domain */   host = URL_HOST(set_url);   diff = strlen(host) - i;   if (diff > 0) {      if (g_strcasecmp(host + diff, cookie->domain))         return FALSE;      if (!is_ip) {         /* "x.y.test.com" is not allowed to set cookies for ".test.com";          *  only an url of the form "y.test.com" would be. */         while ( diff-- )            if (host[diff] == '.')               return FALSE;      }   }   return TRUE;}/* * Strip of the filename from a full path */static char *Cookies_strip_path(const char *path){   char *ret;   int len;   if (path) {      len = strlen(path);      while (len && path[len] != '/')         len--;      ret = g_strndup(path, len + 1);   } else {      ret = g_strdup("/");   }   return ret;}/* * Set the value corresponding to the cookie string */void a_Cookies_set(GList *cookie_strings, const DilloUrl *set_url){   CookieControlAction action;   GSList *list;   if (disabled)      return;   action = Cookies_control_check(set_url);   if (action == COOKIE_DENY) {      DEBUG_MSG(5, "Cookies: denied SET for %s\n", URL_HOST_(set_url));      return;   }   while (cookie_strings != NULL ) {      char *cookie_string = cookie_strings->data;      list = Cookies_parse_string(set_url, cookie_string);      while (list) {         CookieData_t *cookie = list->data;         if (Cookies_validate_domain(cookie, set_url)) {            if (action == COOKIE_ACCEPT_SESSION)               cookie->session_only = TRUE;            Cookies_add_cookie(cookie);         } else {            DEBUG_MSG(5, "Rejecting cookie for %s from %s:\n",                      cookie->domain, URL_STR_(set_url));            Cookies_free_cookie(cookie);         }         list = g_slist_remove(list, list->data);      }      cookie_strings = g_list_next(cookie_strings);   }}/* * Compare the cookie with the supplied data to see if it matches */static gboolean Cookies_match(CookieData_t *cookie, const DilloUrl *url,                              const char *path, gboolean is_ssl){   /* Insecure cookies matches both secure and insecure urls, secure      cookies matches only secure urls */   if (cookie->secure && !is_ssl)      return FALSE;   /* Check that the cookie path is a subpath of the current path */   if (strncmp(cookie->path, path, strlen(cookie->path)) != 0)      return FALSE;   /* Check if the port of the request URL matches any    * of those set in the cookie */   if (cookie->ports) {      GList *list;      int port = URL_PORT(url);      for (list = cookie->ports; list; list = g_list_next(list)) {         if (GPOINTER_TO_INT(list->data) == port)            return TRUE;      }      return FALSE;   }   /* It's a match */   return TRUE;}/* * Return a string that contains all relevant cookies as headers. */char *a_Cookies_get(const DilloUrl *request_url){   char *domain_string, *q, *str, *path;   CookieControlAction action;   CookieData_t *cookie;   GList *matching_cookies = NULL;   GList *domain_cookie;   gboolean is_ssl;   GString *cookie_gstring;   if (disabled)      return g_strdup("");   action = Cookies_control_check(request_url);   if (action == COOKIE_DENY) {      DEBUG_MSG(5, "Cookies: denied GET for %s\n", URL_HOST_(request_url));      return g_strdup("");   }   path = Cookies_strip_path(URL_PATH_(request_url));   /* Check if the protocol is secure or not */   is_ssl = (!g_strcasecmp(URL_SCHEME(request_url), "https"));   for (domain_string = (char *) URL_HOST(request_url);        domain_string != NULL && *domain_string;        domain_string = strchr(domain_string+1, '.')) {      domain_cookie = g_hash_table_lookup(cookies, domain_string);      while (domain_cookie) {         cookie = domain_cookie->data;         domain_cookie = g_list_next(domain_cookie);         /* Remove expired cookie. */         if (!cookie->session_only && cookie->expires_at < time(NULL)) {            Cookies_remove_cookie(cookie);            continue;         }         /* Check if the cookie matches the requesting URL */         if (Cookies_match(cookie, request_url, path, is_ssl))            matching_cookies = g_list_append(matching_cookies, cookie);      }   }   /* Found the cookies, now make the string */   cookie_gstring = g_string_new("");   if (matching_cookies != NULL) {      CookieData_t *first_cookie = matching_cookies->data;      g_string_sprintfa(cookie_gstring, "Cookie: ");      if (first_cookie->version != 0)         g_string_sprintfa(cookie_gstring, "$Version=\"%d\"; ",                           first_cookie->version);      while (matching_cookies) {         cookie = matching_cookies->data;         q = (cookie->version == 0 ? "" : "\"");         g_string_sprintfa(cookie_gstring,                           "%s=%s; $Path=%s%s%s; $Domain=%s%s%s",                           cookie->name, cookie->value,                           q, cookie->path, q, q, cookie->domain, q);         if (cookie->ports) {            char *ports_str = Cookies_build_ports_str(cookie);            g_string_sprintfa(cookie_gstring, "; $Port=%s", ports_str);            g_free(ports_str);         }         matching_cookies = g_list_next(matching_cookies);         g_string_append(cookie_gstring, matching_cookies ? "; " : "\r\n");      }      DEBUG_MSG(4, "Final cookie string: %s", cookie_gstring->str);   }   g_free(path);   str = cookie_gstring->str;   g_string_free(cookie_gstring, FALSE);   return str;}/* ------------------------------------------------------------- *                    Access control routines * ------------------------------------------------------------- *//* * Get the cookie control rules (from cookiesrc). * Return value: *   0 = Parsed OK, with cookies enabled *   1 = Parsed OK, with cookies disabled *   2 = Can't open the control file */static int Cookie_control_init(void){   CookieControl cc;   FILE *stream;   char *filename;   char line[LINE_MAXLEN];   char domain[LINE_MAXLEN];   char rule[LINE_MAXLEN];   int i, j;   gboolean enabled = FALSE;   /* Get a file pointer */   filename = a_Misc_prepend_user_home(".dillo/cookiesrc");   stream = Cookies_fopen(filename, "DEFAULT DENY\n");   g_free(filename);   if (!stream)      return 2;   /* Get all lines in the file */   while (!feof(stream)) {      line[0] = '\0';      fgets(line, LINE_MAXLEN, stream);      /* Remove leading and trailing whitespaces */      g_strstrip(line);      if (line[0] != '\0' && line[0] != '#') {         i = 0;         j = 0;         /* Get the domain */         while (!isspace(line[i]))            domain[j++] = line[i++];         domain[j] = '\0';         /* Skip past whitespaces */         i++;         while (isspace(line[i]))            i++;         /* Get the rule */         j = 0;         while (line[i] != '\0' && !isspace(line[i]))            rule[j++] = line[i++];         rule[j] = '\0';         if (g_strcasecmp(rule, "ACCEPT") == 0)            cc.action = COOKIE_ACCEPT;         else if (g_strcasecmp(rule, "ACCEPT_SESSION") == 0)            cc.action = COOKIE_ACCEPT_SESSION;         else if (g_strcasecmp(rule, "DENY") == 0)            cc.action = COOKIE_DENY;         else {            MSG("Cookies: rule '%s' for domain '%s' is not recognised.\n",                rule, domain);            continue;         }         cc.domain = g_strdup(domain);         if (g_strcasecmp(cc.domain, "DEFAULT") == 0) {            /* Set the default action */            default_action = cc.action;            g_free(cc.domain);         } else {            a_List_add(ccontrol, num_ccontrol, num_ccontrol_max);            ccontrol[num_ccontrol++] = cc;         }         if (cc.action != COOKIE_DENY)            enabled = TRUE;      }   }   fclose(stream);   return (enabled ? 0 : 1);}/* * Check the rules for an appropriate action for this domain */static CookieControlAction Cookies_control_check_domain(const char *domain){   int i, diff;   for (i = 0; i < num_ccontrol; i++) {      if (ccontrol[i].domain[0] == '.') {         diff = strlen(domain) - strlen(ccontrol[i].domain);         if (diff >= 0) {            if (g_strcasecmp(domain + diff, ccontrol[i].domain) != 0)               continue;         } else {            continue;         }      } else {         if (g_strcasecmp(domain, ccontrol[i].domain) != 0)            continue;      }      /* If we got here we have a match */      return( ccontrol[i].action );   }   return default_action;}/* * Same as the above except it takes an URL */static CookieControlAction Cookies_control_check(const DilloUrl *url){   return Cookies_control_check_domain(URL_HOST(url));}#endif /* !DISABLE_COOKIES */