1 /*
2 * ====================================================================
3 * Licensed to the Apache Software Foundation (ASF) under one
4 * or more contributor license agreements. See the NOTICE file
5 * distributed with this work for additional information
6 * regarding copyright ownership. The ASF licenses this file
7 * to you under the Apache License, Version 2.0 (the
8 * "License"); you may not use this file except in compliance
9 * with the License. You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing,
14 * software distributed under the License is distributed on an
15 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
16 * KIND, either express or implied. See the License for the
17 * specific language governing permissions and limitations
18 * under the License.
19 * ====================================================================
20 *
21 * This software consists of voluntary contributions made by many
22 * individuals on behalf of the Apache Software Foundation. For more
23 * information on the Apache Software Foundation, please see
24 * <http://www.apache.org/>.
25 *
26 */
27 package org.apache.http.impl.cookie;
28
29 import java.util.Collection;
30 import java.util.HashSet;
31 import java.util.Set;
32
33 import org.apache.http.client.utils.Punycode;
34 import org.apache.http.cookie.Cookie;
35 import org.apache.http.cookie.CookieAttributeHandler;
36 import org.apache.http.cookie.CookieOrigin;
37 import org.apache.http.cookie.MalformedCookieException;
38 import org.apache.http.cookie.SetCookie;
39
40 /**
41 * Wraps a CookieAttributeHandler and leverages its match method
42 * to never match a suffix from a black list. May be used to provide
43 * additional security for cross-site attack types by preventing
44 * cookies from apparent domains that are not publicly available.
45 * An uptodate list of suffixes can be obtained from
46 * <a href="http://publicsuffix.org/">publicsuffix.org</a>
47 *
48 * @since 4.0
49 */
50 public class PublicSuffixFilter implements CookieAttributeHandler {
51 private final CookieAttributeHandler wrapped;
52 private Set<String> exceptions;
53 private Set<String> suffixes;
54
55 public PublicSuffixFilter(final CookieAttributeHandler wrapped) {
56 this.wrapped = wrapped;
57 }
58
59 /**
60 * Sets the suffix blacklist patterns.
61 * A pattern can be "com", "*.jp"
62 * TODO add support for patterns like "lib.*.us"
63 * @param suffixes
64 */
65 public void setPublicSuffixes(final Collection<String> suffixes) {
66 this.suffixes = new HashSet<String>(suffixes);
67 }
68
69 /**
70 * Sets the exceptions from the blacklist. Exceptions can not be patterns.
71 * TODO add support for patterns
72 * @param exceptions
73 */
74 public void setExceptions(final Collection<String> exceptions) {
75 this.exceptions = new HashSet<String>(exceptions);
76 }
77
78 /**
79 * Never matches if the cookie's domain is from the blacklist.
80 */
81 public boolean match(final Cookie cookie, final CookieOrigin origin) {
82 if (isForPublicSuffix(cookie)) {
83 return false;
84 }
85 return wrapped.match(cookie, origin);
86 }
87
88 public void parse(final SetCookie cookie, final String value) throws MalformedCookieException {
89 wrapped.parse(cookie, value);
90 }
91
92 public void validate(final Cookie cookie, final CookieOrigin origin) throws MalformedCookieException {
93 wrapped.validate(cookie, origin);
94 }
95
96 private boolean isForPublicSuffix(final Cookie cookie) {
97 String domain = cookie.getDomain();
98 if (domain.startsWith(".")) {
99 domain = domain.substring(1);
100 }
101 domain = Punycode.toUnicode(domain);
102
103 // An exception rule takes priority over any other matching rule.
104 if (this.exceptions != null) {
105 if (this.exceptions.contains(domain)) {
106 return false;
107 }
108 }
109
110
111 if (this.suffixes == null) {
112 return false;
113 }
114
115 do {
116 if (this.suffixes.contains(domain)) {
117 return true;
118 }
119 // patterns
120 if (domain.startsWith("*.")) {
121 domain = domain.substring(2);
122 }
123 final int nextdot = domain.indexOf('.');
124 if (nextdot == -1) {
125 break;
126 }
127 domain = "*" + domain.substring(nextdot);
128 } while (domain.length() > 0);
129
130 return false;
131 }
132 }