1 /*
2 * $HeadURL$
3 * $Revision: 1470921 $
4 * $Date: 2013-04-23 12:42:29 +0000 (Tue, 23 Apr 2013) $
5 *
6 * ====================================================================
7 * Licensed to the Apache Software Foundation (ASF) under one
8 * or more contributor license agreements. See the NOTICE file
9 * distributed with this work for additional information
10 * regarding copyright ownership. The ASF licenses this file
11 * to you under the Apache License, Version 2.0 (the
12 * "License"); you may not use this file except in compliance
13 * with the License. You may obtain a copy of the License at
14 *
15 * http://www.apache.org/licenses/LICENSE-2.0
16 *
17 * Unless required by applicable law or agreed to in writing,
18 * software distributed under the License is distributed on an
19 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
20 * KIND, either express or implied. See the License for the
21 * specific language governing permissions and limitations
22 * under the License.
23 * ====================================================================
24 *
25 * This software consists of voluntary contributions made by many
26 * individuals on behalf of the Apache Software Foundation. For more
27 * information on the Apache Software Foundation, please see
28 * <http://www.apache.org/>.
29 *
30 */
31
32 package org.apache.http.impl.cookie;
33
34 import java.util.Collection;
35 import java.util.HashSet;
36 import java.util.Set;
37
38 import org.apache.http.client.utils.Punycode;
39 import org.apache.http.cookie.Cookie;
40 import org.apache.http.cookie.CookieAttributeHandler;
41 import org.apache.http.cookie.CookieOrigin;
42 import org.apache.http.cookie.MalformedCookieException;
43 import org.apache.http.cookie.SetCookie;
44
45 /**
46 * Wraps a CookieAttributeHandler and leverages its match method
47 * to never match a suffix from a black list. May be used to provide
48 * additional security for cross-site attack types by preventing
49 * cookies from apparent domains that are not publicly available.
50 * An uptodate list of suffixes can be obtained from
51 * <a href="http://publicsuffix.org/">publicsuffix.org</a>
52 *
53 * @since 4.0
54 */
55 public class PublicSuffixFilter implements CookieAttributeHandler {
56 private final CookieAttributeHandler wrapped;
57 private Set<String> exceptions;
58 private Set<String> suffixes;
59
60 public PublicSuffixFilter(CookieAttributeHandler wrapped) {
61 this.wrapped = wrapped;
62 }
63
64 /**
65 * Sets the suffix blacklist patterns.
66 * A pattern can be "com", "*.jp"
67 * TODO add support for patterns like "lib.*.us"
68 * @param suffixes
69 */
70 public void setPublicSuffixes(Collection<String> suffixes) {
71 this.suffixes = new HashSet<String>(suffixes);
72 }
73
74 /**
75 * Sets the exceptions from the blacklist. Exceptions can not be patterns.
76 * TODO add support for patterns
77 * @param exceptions
78 */
79 public void setExceptions(Collection<String> exceptions) {
80 this.exceptions = new HashSet<String>(exceptions);
81 }
82
83 /**
84 * Never matches if the cookie's domain is from the blacklist.
85 */
86 public boolean match(Cookie cookie, CookieOrigin origin) {
87 if (isForPublicSuffix(cookie)) return false;
88 return wrapped.match(cookie, origin);
89 }
90
91 public void parse(SetCookie cookie, String value) throws MalformedCookieException {
92 wrapped.parse(cookie, value);
93 }
94
95 public void validate(Cookie cookie, CookieOrigin origin) throws MalformedCookieException {
96 wrapped.validate(cookie, origin);
97 }
98
99 private boolean isForPublicSuffix(Cookie cookie) {
100 String domain = cookie.getDomain();
101 if (domain.startsWith(".")) domain = domain.substring(1);
102 domain = Punycode.toUnicode(domain);
103
104 // An exception rule takes priority over any other matching rule.
105 if (this.exceptions != null) {
106 if (this.exceptions.contains(domain)) return false;
107 }
108
109
110 if (this.suffixes == null) return false;
111
112 do {
113 if (this.suffixes.contains(domain)) return true;
114 // patterns
115 if (domain.startsWith("*.")) domain = domain.substring(2);
116 int nextdot = domain.indexOf('.');
117 if (nextdot == -1) break;
118 domain = "*" + domain.substring(nextdot);
119 } while (domain.length() > 0);
120
121 return false;
122 }
123 }