View Javadoc

1   /*
2    * ====================================================================
3    * Licensed to the Apache Software Foundation (ASF) under one
4    * or more contributor license agreements.  See the NOTICE file
5    * distributed with this work for additional information
6    * regarding copyright ownership.  The ASF licenses this file
7    * to you under the Apache License, Version 2.0 (the
8    * "License"); you may not use this file except in compliance
9    * with the License.  You may obtain a copy of the License at
10   *
11   *   http://www.apache.org/licenses/LICENSE-2.0
12   *
13   * Unless required by applicable law or agreed to in writing,
14   * software distributed under the License is distributed on an
15   * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
16   * KIND, either express or implied.  See the License for the
17   * specific language governing permissions and limitations
18   * under the License.
19   * ====================================================================
20   *
21   * This software consists of voluntary contributions made by many
22   * individuals on behalf of the Apache Software Foundation.  For more
23   * information on the Apache Software Foundation, please see
24   * <http://www.apache.org/>.
25   *
26   */
27  package org.apache.http.impl.cookie;
28  
29  import java.util.Collection;
30  import java.util.HashSet;
31  import java.util.Set;
32  
33  import org.apache.http.client.utils.Punycode;
34  import org.apache.http.cookie.Cookie;
35  import org.apache.http.cookie.CookieAttributeHandler;
36  import org.apache.http.cookie.CookieOrigin;
37  import org.apache.http.cookie.MalformedCookieException;
38  import org.apache.http.cookie.SetCookie;
39  
40  /**
41   * Wraps a CookieAttributeHandler and leverages its match method
42   * to never match a suffix from a black list. May be used to provide
43   * additional security for cross-site attack types by preventing
44   * cookies from apparent domains that are not publicly available.
45   * An uptodate list of suffixes can be obtained from
46   * <a href="http://publicsuffix.org/">publicsuffix.org</a>
47   *
48   * @since 4.0
49   */
50  public class PublicSuffixFilter implements CookieAttributeHandler {
51      private final CookieAttributeHandler wrapped;
52      private Set<String> exceptions;
53      private Set<String> suffixes;
54  
55      public PublicSuffixFilter(final CookieAttributeHandler wrapped) {
56          this.wrapped = wrapped;
57      }
58  
59      /**
60       * Sets the suffix blacklist patterns.
61       * A pattern can be "com", "*.jp"
62       * TODO add support for patterns like "lib.*.us"
63       * @param suffixes
64       */
65      public void setPublicSuffixes(final Collection<String> suffixes) {
66          this.suffixes = new HashSet<String>(suffixes);
67      }
68  
69      /**
70       * Sets the exceptions from the blacklist. Exceptions can not be patterns.
71       * TODO add support for patterns
72       * @param exceptions
73       */
74      public void setExceptions(final Collection<String> exceptions) {
75          this.exceptions = new HashSet<String>(exceptions);
76      }
77  
78      /**
79       * Never matches if the cookie's domain is from the blacklist.
80       */
81      @Override
82      public boolean match(final Cookie cookie, final CookieOrigin origin) {
83          if (isForPublicSuffix(cookie)) {
84              return false;
85          }
86          return wrapped.match(cookie, origin);
87      }
88  
89      @Override
90      public void parse(final SetCookie cookie, final String value) throws MalformedCookieException {
91          wrapped.parse(cookie, value);
92      }
93  
94      @Override
95      public void validate(final Cookie cookie, final CookieOrigin origin) throws MalformedCookieException {
96          wrapped.validate(cookie, origin);
97      }
98  
99      private boolean isForPublicSuffix(final Cookie cookie) {
100         String domain = cookie.getDomain();
101         if (domain.startsWith(".")) {
102             domain = domain.substring(1);
103         }
104         domain = Punycode.toUnicode(domain);
105 
106         // An exception rule takes priority over any other matching rule.
107         if (this.exceptions != null) {
108             if (this.exceptions.contains(domain)) {
109                 return false;
110             }
111         }
112 
113 
114         if (this.suffixes == null) {
115             return false;
116         }
117 
118         do {
119             if (this.suffixes.contains(domain)) {
120                 return true;
121             }
122             // patterns
123             if (domain.startsWith("*.")) {
124                 domain = domain.substring(2);
125             }
126             final int nextdot = domain.indexOf('.');
127             if (nextdot == -1) {
128                 break;
129             }
130             domain = "*" + domain.substring(nextdot);
131         } while (!domain.isEmpty());
132 
133         return false;
134     }
135 }