Revision control
Copy as Markdown
// Copyright (C) 2016 The Qt Company Ltd.
// SPDX-License-Identifier: LicenseRef-Qt-Commercial OR GPL-3.0-only
#include <QTest>
#include <QtCore/QJsonArray>
#include <QtCore/QJsonDocument>
#include <QtCore/QJsonObject>
#include <QtCore/QJsonValue>
#include <QtNetwork/QNetworkCookieJar>
#include <QtNetwork/QNetworkCookie>
#include <QtNetwork/QNetworkRequest>
#if QT_CONFIG(topleveldomain)
#include "private/qtldurl_p.h"
#endif
#include <memory>
class tst_QNetworkCookieJar: public QObject
{
Q_OBJECT
private slots:
void initTestCase();
void getterSetter();
void setCookiesFromUrl_data();
void setCookiesFromUrl();
void cookiesForUrl_data();
void cookiesForUrl();
#if defined(QT_BUILD_INTERNAL) && QT_CONFIG(topleveldomain)
void effectiveTLDs_data();
void effectiveTLDs();
#endif
void rfc6265_data();
void rfc6265();
private:
QSharedPointer<QTemporaryDir> m_dataDir;
};
class MyCookieJar: public QNetworkCookieJar
{
public:
~MyCookieJar() override;
using QNetworkCookieJar::allCookies;
using QNetworkCookieJar::setAllCookies;
};
MyCookieJar::~MyCookieJar() = default;
void tst_QNetworkCookieJar::getterSetter()
{
MyCookieJar jar;
QVERIFY(jar.allCookies().isEmpty());
QList<QNetworkCookie> list;
QNetworkCookie cookie;
cookie.setName("a");
list << cookie;
jar.setAllCookies(list);
QCOMPARE(jar.allCookies(), list);
}
void tst_QNetworkCookieJar::initTestCase()
{
#if QT_CONFIG(topleveldomain) && QT_CONFIG(publicsuffix_system)
QString testDataDir;
#ifdef BUILTIN_TESTDATA
m_dataDir = QEXTRACTTESTDATA("/testdata");
QVERIFY(m_dataDir);
testDataDir = m_dataDir->path() + "/testdata";
#else
testDataDir = QFINDTESTDATA("testdata");
#endif
qDebug() << "Test data dir:" << testDataDir;
qputenv("XDG_DATA_DIRS", QFile::encodeName(testDataDir));
#endif
}
void tst_QNetworkCookieJar::setCookiesFromUrl_data()
{
QTest::addColumn<QList<QNetworkCookie> >("preset");
QTest::addColumn<QNetworkCookie>("newCookie");
QTest::addColumn<QString>("referenceUrl");
QTest::addColumn<QList<QNetworkCookie> >("expectedResult");
QTest::addColumn<bool>("setCookies");
QList<QNetworkCookie> preset;
QList<QNetworkCookie> result;
QNetworkCookie cookie;
cookie.setName("a");
cookie.setPath("/");
cookie.setDomain(".foo.tld");
result += cookie;
preset = result;
cookie.setValue("bc");
result.clear();
result += cookie;
preset = result;
cookie.setName("d");
result += cookie;
cookie = preset.at(0);
result = preset;
cookie.setPath("/something");
result += cookie;
preset.clear();
preset += cookie;
cookie.setPath("/");
preset.clear();
result.clear();
QNetworkCookie finalCookie = cookie;
cookie.setDomain("foo.tld");
finalCookie.setDomain(".foo.tld");
result += finalCookie;
QTest::newRow("should-add-dot-prefix") << preset << cookie << "http://www.foo.tld" << result << true;
result.clear();
cookie.setDomain("");
finalCookie.setDomain("www.foo.tld");
result += finalCookie;
QTest::newRow("should-set-default-domain") << preset << cookie << "http://www.foo.tld" << result << true;
// security test:
result.clear();
preset.clear();
cookie.setDomain("something.completely.different");
// we want the cookie to be accepted although the path does not match, see QTBUG-5815
cookie.setDomain(".foo.tld");
cookie.setPath("/something");
result += cookie;
// check effective TLDs
// 1. co.uk is an effective TLD, should be denied
result.clear();
preset.clear();
cookie.setPath("/");
cookie.setDomain(".co.uk");
QTest::newRow("effective-tld1-denied") << preset << cookie << "http://something.co.uk" << result << false;
cookie.setDomain("co.uk");
QTest::newRow("effective-tld1-denied2") << preset << cookie << "http://something.co.uk" << result << false;
cookie.setDomain(".something.co.uk");
result += cookie;
QTest::newRow("effective-tld1-accepted") << preset << cookie << "http://something.co.uk" << result << true;
// 2. anything .ck is an effective TLD ('*.ck'), but 'www.ck' is an exception
result.clear();
preset.clear();
cookie.setDomain(".ck");
result.clear();
preset.clear();
cookie.setDomain(".foo.ck");
result += cookie;
result.clear();
QTest::newRow("effective-tld2-denied2") << preset << cookie << "http://www.foo.ck" << result << false;
QTest::newRow("effective-tld2-denied3") << preset << cookie << "http://www.anything.foo.ck" << result << false;
cookie.setDomain(".www.ck");
result += cookie;
QTest::newRow("effective-tld2-accepted") << preset << cookie << "http://www.www.ck" << result << true;
result.clear();
preset.clear();
cookie.setDomain("127.0.0.1");
result += cookie;
QTest::newRow("IPv4-address-as-domain") << preset << cookie << "http://127.0.0.1/" << result << true;
result.clear();
preset.clear();
cookie.setDomain("fe80::250:56ff:fec0:1");
result += cookie;
QTest::newRow("IPv6-address-as-domain") << preset << cookie << "http://[fe80::250:56ff:fec0:1]/" << result << true;
// setting the defaults:
finalCookie = cookie;
finalCookie.setPath("/something/");
finalCookie.setDomain("www.foo.tld");
cookie.setPath("");
cookie.setDomain("");
result.clear();
result += finalCookie;
QTest::newRow("defaults-1") << preset << cookie << "http://www.foo.tld/something/" << result << true;
finalCookie.setPath("/");
result.clear();
result += finalCookie;
// security test: do not accept cookie domains like ".com" nor ".com." (see RFC 2109 section 4.3.2)
result.clear();
preset.clear();
cookie.setDomain(".com");
result.clear();
preset.clear();
cookie.setDomain(".com.");
// When using a TLD as a hostname the hostname should still get cookies (QTBUG-52040)
// ... and nothing else should get the cookies.
result.clear();
preset.clear();
cookie.setPath("/");
cookie.setDomain(".support");
result += cookie;
result.clear();
QTest::newRow("TLD-as-domain-rejected") << preset << cookie << "http://a.support" << result << false;
// Now test with no domain in the cookie, use the domain from the url (matching TLD)
cookie.setDomain("support");
result += cookie;
cookie.setDomain("");
}
void tst_QNetworkCookieJar::setCookiesFromUrl()
{
QFETCH(QList<QNetworkCookie>, preset);
QFETCH(QNetworkCookie, newCookie);
QFETCH(QString, referenceUrl);
QFETCH(const QList<QNetworkCookie>, expectedResult);
QFETCH(bool, setCookies);
QList<QNetworkCookie> cookieList;
cookieList += newCookie;
MyCookieJar jar;
jar.setAllCookies(preset);
QCOMPARE(jar.setCookiesFromUrl(cookieList, referenceUrl), setCookies);
QList<QNetworkCookie> result = jar.allCookies();
for (const QNetworkCookie &cookie : expectedResult) {
QVERIFY2(result.contains(cookie), cookie.toRawForm());
result.removeAll(cookie);
}
QVERIFY2(result.isEmpty(), std::unique_ptr<char[]>(QTest::toString(result)).get());
}
void tst_QNetworkCookieJar::cookiesForUrl_data()
{
QTest::addColumn<QList<QNetworkCookie> >("allCookies");
QTest::addColumn<QString>("url");
QTest::addColumn<QList<QNetworkCookie> >("expectedResult");
QList<QNetworkCookie> allCookies;
QList<QNetworkCookie> result;
QNetworkCookie cookie;
cookie.setName("a");
cookie.setPath("/web");
cookie.setDomain(".qt-project.org");
allCookies += cookie;
result = allCookies;
cookie.setPath("/web/wiki");
allCookies += cookie;
// exact same results as before:
result.prepend(cookie); // longer path, it must match first
// invert the order;
allCookies.clear();
allCookies << result.at(1) << result.at(0);
// expired cookie
allCookies.clear();
cookie.setExpirationDate(QDateTime::fromString("09-Nov-1999", "dd-MMM-yyyy"));
allCookies += cookie;
result.clear();
// path matching
allCookies.clear();
QNetworkCookie anotherCookie;
anotherCookie.setName("a");
anotherCookie.setPath("/web");
anotherCookie.setDomain(".qt-project.org");
allCookies += anotherCookie;
result.clear();
result += anotherCookie;
// secure cookies
allCookies.clear();
result.clear();
QNetworkCookie secureCookie;
secureCookie.setName("a");
secureCookie.setPath("/web");
secureCookie.setDomain(".qt-project.org");
secureCookie.setSecure(true);
allCookies += secureCookie;
result += secureCookie;
// domain ending in .
allCookies.clear();
result.clear();
QNetworkCookie cookieDot;
cookieDot.setDomain(".example.com.");
cookieDot.setName("a");
allCookies += cookieDot;
result += cookieDot;
// Root path in cookie, empty url path
allCookies.clear();
QNetworkCookie rootCookie;
rootCookie.setName("a");
rootCookie.setPath("/");
rootCookie.setDomain("qt-project.org");
allCookies += rootCookie;
result.clear();
result += rootCookie;
// Domain in cookie happens to match a TLD
allCookies.clear();
QNetworkCookie tldCookie;
tldCookie.setDomain(".support");
tldCookie.setName("a");
tldCookie.setValue("b");
allCookies += tldCookie;
result.clear();
result += tldCookie;
result.clear();
}
void tst_QNetworkCookieJar::cookiesForUrl()
{
QFETCH(QList<QNetworkCookie>, allCookies);
QFETCH(QString, url);
QFETCH(QList<QNetworkCookie>, expectedResult);
MyCookieJar jar;
jar.setAllCookies(allCookies);
QList<QNetworkCookie> result = jar.cookiesForUrl(url);
QCOMPARE(result, expectedResult);
}
// This test requires private API.
#if defined(QT_BUILD_INTERNAL) && QT_CONFIG(topleveldomain)
void tst_QNetworkCookieJar::effectiveTLDs_data()
{
QTest::addColumn<QString>("domain");
QTest::addColumn<bool>("isTLD");
QTest::newRow("yes1") << "com" << true;
QTest::newRow("yes2") << "de" << true;
QTest::newRow("yes4") << "krodsherad.no" << true;
QTest::newRow("yes5") << "1.bg" << true;
QTest::newRow("yes6") << "com.cn" << true;
QTest::newRow("yes7") << "org.ws" << true;
QTest::newRow("yes8") << "co.uk" << true;
QTest::newRow("yes10") << "hk.com" << true;
QTest::newRow("yes11") << "hk.org" << true;
QTest::newRow("no1") << "anything.com" << false;
QTest::newRow("no2") << "anything.de" << false;
QTest::newRow("no3") << "eselsberg.ulm.museum" << false;
QTest::newRow("no4") << "noe.krodsherad.no" << false;
QTest::newRow("no5") << "2.1.bg" << false;
QTest::newRow("no6") << "foo.com.cn" << false;
QTest::newRow("no7") << "something.org.ws" << false;
QTest::newRow("no8") << "teatime.co.uk" << false;
QTest::newRow("no9") << "bla" << false;
QTest::newRow("no10") << "bla.bla" << false;
QTest::newRow("no11") << "mosreg.ru" << false;
const char16_t s1[] = {0x74, 0x72, 0x61, 0x6e, 0xf8, 0x79, 0x2e, 0x6e, 0x6f, 0x00}; // xn--trany-yua.no
const char16_t s3[] = {0x7ec4, 0x7e54, 0x2e, 0x68, 0x6b, 0x00}; // xn--mk0axi.hk
const char16_t s4[] = {0x7f51, 0x7edc, 0x2e, 0x63, 0x6e, 0x00}; // xn--io0a7i.cn
const char16_t s5[] = {0x72, 0xe1, 0x68, 0x6b, 0x6b, 0x65, 0x72, 0xe1, 0x76, 0x6a, 0x75, 0x2e, 0x6e, 0x6f, 0x00}; // xn--rhkkervju-01af.no
const char16_t s6[] = {0xb9a, 0xbbf, 0xb99, 0xbcd, 0xb95, 0xbaa, 0xbcd, 0xbaa, 0xbc2, 0xbb0, 0xbcd, 0x00}; // xn--clchc0ea0b2g2a9gcd
const char16_t s7[] = {0x627, 0x644, 0x627, 0x631, 0x62f, 0x646, 0x00}; // xn--mgbayh7gpa
QTest::newRow("yes-specialchars1") << QString::fromUtf16(s1) << true;
QTest::newRow("yes-specialchars3") << QString::fromUtf16(s3) << true;
QTest::newRow("yes-specialchars4") << QString::fromUtf16(s4) << true;
QTest::newRow("yes-specialchars5") << QString::fromUtf16(s5) << true;
QTest::newRow("yes-specialchars6") << QString::fromUtf16(s6) << true;
QTest::newRow("yes-specialchars7") << QString::fromUtf16(s7) << true;
QTest::newRow("no-specialchars1") << QString::fromUtf16(s1).prepend("something") << false;
QTest::newRow("no-specialchars3") << QString::fromUtf16(s3).prepend("foo") << false;
QTest::newRow("no-specialchars4") << QString::fromUtf16(s4).prepend("bar") << false;
QTest::newRow("no-specialchars6") << QString::fromUtf16(s6).prepend(QLatin1Char('.') + QString::fromUtf16(s6)) << false;
QTest::newRow("no-specialchars7") << QString::fromUtf16(s7).prepend("bla") << false;
QTest::newRow("exception1") << "pref.iwate.jp" << false;
QTest::newRow("exception2") << "omanpost.om" << false;
QTest::newRow("exception3") << "omantel.om" << false;
QTest::newRow("exception4") << "gobiernoelectronico.ar" << false;
QTest::newRow("exception5") << "pref.ishikawa.jp" << false;
QTest::newRow("yes-wildcard1") << "*.jm" << true;
QTest::newRow("yes-wildcard1.5") << "anything.jm" << true;
QTest::newRow("yes-wildcard2") << "something.ck" << true;
QTest::newRow("no-wildcard3") << "whatever.uk" << false; // was changed at some point
QTest::newRow("yes-wildcard4") << "anything.sendai.jp" << true;
QTest::newRow("yes-wildcard5") << "foo.sch.uk" << true;
QTest::newRow("yes-platform.sh") << "eu.platform.sh" << true;
QTest::newRow("no-platform.sh") << "something.platform.sh" << false;
}
void tst_QNetworkCookieJar::effectiveTLDs()
{
QFETCH(QString, domain);
QFETCH(bool, isTLD);
QCOMPARE(qIsEffectiveTLD(domain), isTLD);
}
#endif
void tst_QNetworkCookieJar::rfc6265_data()
{
QTest::addColumn<QStringList>("received");
QTest::addColumn<QList<QNetworkCookie> >("sent");
QTest::addColumn<QString>("sentTo");
QFile file(QFINDTESTDATA("parser.json"));
QVERIFY(file.open(QFile::ReadOnly | QFile::Text));
QJsonDocument document;
document = QJsonDocument::fromJson(file.readAll());
QVERIFY(!document.isNull());
QVERIFY(document.isArray());
for (const QJsonValue testCase : document.array()) {
QJsonObject testObject = testCase.toObject();
//"test" - the test case name
QString testCaseName = testObject.value("test").toString();
if (testCaseName.toLower().startsWith("disabled"))
continue;
//"received" - the cookies received from the server
const QJsonArray received = testObject.value("received").toArray();
QStringList receivedList;
for (const QJsonValue receivedCookie : received)
receivedList.append(receivedCookie.toString());
//"sent" - the cookies sent back to the server
const QJsonArray sent = testObject.value("sent").toArray();
QList<QNetworkCookie> sentList;
for (const QJsonValue sentCookie : sent) {
QJsonObject sentCookieObject = sentCookie.toObject();
QNetworkCookie cookie;
cookie.setName(sentCookieObject.value("name").toString().toUtf8());
cookie.setValue(sentCookieObject.value("value").toString().toUtf8());
sentList.append(cookie);
}
//"sent-to" - the relative url where cookies are sent
QTest::newRow(qPrintable(testCaseName)) << receivedList << sentList << testObject.value("sent-to").toString();
}
}
void tst_QNetworkCookieJar::rfc6265()
{
QFETCH(const QStringList, received);
QFETCH(QList<QNetworkCookie>, sent);
QFETCH(QString, sentTo);
if (!sentTo.isEmpty())
sentUrl = receivedUrl.resolved(sentTo);
QNetworkCookieJar jar;
QList<QNetworkCookie> receivedCookies;
for (const QString &cookieLine : received)
receivedCookies.append(QNetworkCookie::parseCookies(cookieLine.toUtf8()));
jar.setCookiesFromUrl(receivedCookies, receivedUrl);
QList<QNetworkCookie> cookiesToSend = jar.cookiesForUrl(sentUrl);
//compare cookies only using name/value, as the metadata isn't sent over the network
QCOMPARE(cookiesToSend.size(), sent.size());
bool ok = true;
for (int i = 0; i < cookiesToSend.size(); i++) {
if (cookiesToSend.at(i).name() != sent.at(i).name()) {
ok = false;
break;
}
if (cookiesToSend.at(i).value() != sent.at(i).value()) {
ok = false;
break;
}
}
if (!ok) {
QNetworkRequest r(sentUrl);
r.setHeader(QNetworkRequest::CookieHeader, QVariant::fromValue(cookiesToSend));
QString actual = QString::fromUtf8(r.rawHeader("Cookie"));
r.setHeader(QNetworkRequest::CookieHeader, QVariant::fromValue(sent));
QString expected = QString::fromUtf8(r.rawHeader("Cookie"));
QVERIFY2(ok, qPrintable(QString("Expected: %1\nActual: %2").arg(expected).arg(actual)));
}
}
QTEST_MAIN(tst_QNetworkCookieJar)
#include "tst_qnetworkcookiejar.moc"