node-tough-cookie/test/parsing_test.js

757 lines
22 KiB
JavaScript

/*!
* Copyright (c) 2015, Salesforce.com, Inc.
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are met:
*
* 1. Redistributions of source code must retain the above copyright notice,
* this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright notice,
* this list of conditions and the following disclaimer in the documentation
* and/or other materials provided with the distribution.
*
* 3. Neither the name of Salesforce.com nor the names of its contributors may
* be used to endorse or promote products derived from this software without
* specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
* AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
* LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*/
"use strict";
const vows = require("vows");
const assert = require("assert");
const tough = require("../lib/cookie");
const Cookie = tough.Cookie;
const LOTS_OF_SEMICOLONS = ";".repeat(65535);
const LOTS_OF_SPACES = " ".repeat(65535);
vows
.describe("Parsing")
.addBatch({
simple: {
topic: function() {
return Cookie.parse("a=bcd") || null;
},
parsed: function(c) {
assert.ok(c);
},
key: function(c) {
assert.equal(c.key, "a");
},
value: function(c) {
assert.equal(c.value, "bcd");
},
"no path": function(c) {
assert.equal(c.path, null);
},
"no domain": function(c) {
assert.equal(c.domain, null);
},
"no extensions": function(c) {
assert.ok(!c.extensions);
}
},
"with expiry": {
topic: function() {
return (
Cookie.parse("a=bcd; Expires=Tue, 18 Oct 2011 07:05:03 GMT") || null
);
},
parsed: function(c) {
assert.ok(c);
},
key: function(c) {
assert.equal(c.key, "a");
},
value: function(c) {
assert.equal(c.value, "bcd");
},
"has expires": function(c) {
assert.ok(
c.expires !== Infinity,
"expiry is infinite when it shouldn't be"
);
assert.equal(c.expires.getTime(), 1318921503000);
}
},
"with expiry and path": {
topic: function() {
return (
Cookie.parse(
'abc="xyzzy!"; Expires=Tue, 18 Oct 2011 07:05:03 GMT; Path=/aBc'
) || null
);
},
parsed: function(c) {
assert.ok(c);
},
key: function(c) {
assert.equal(c.key, "abc");
},
value: function(c) {
assert.equal(c.value, '"xyzzy!"');
},
"has expires": function(c) {
assert.ok(
c.expires !== Infinity,
"expiry is infinite when it shouldn't be"
);
assert.equal(c.expires.getTime(), 1318921503000);
},
"has path": function(c) {
assert.equal(c.path, "/aBc");
},
"no httponly or secure": function(c) {
assert.ok(!c.httpOnly);
assert.ok(!c.secure);
}
},
"with most things": {
topic: function() {
return (
Cookie.parse(
'abc="xyzzy!"; Expires=Tue, 18 Oct 2011 07:05:03 GMT; Path=/aBc; Domain=example.com; Secure; HTTPOnly; Max-Age=1234; Foo=Bar; Baz'
) || null
);
},
parsed: function(c) {
assert.ok(c);
},
key: function(c) {
assert.equal(c.key, "abc");
},
value: function(c) {
assert.equal(c.value, '"xyzzy!"');
},
"has expires": function(c) {
assert.ok(
c.expires !== Infinity,
"expiry is infinite when it shouldn't be"
);
assert.equal(c.expires.getTime(), 1318921503000);
},
"has path": function(c) {
assert.equal(c.path, "/aBc");
},
"has domain": function(c) {
assert.equal(c.domain, "example.com");
},
"has httponly": function(c) {
assert.equal(c.httpOnly, true);
},
"has secure": function(c) {
assert.equal(c.secure, true);
},
"has max-age": function(c) {
assert.equal(c.maxAge, 1234);
},
"has same-site 'undefined'": function(c) {
assert.equal(c.sameSite, undefined);
},
"has extensions": function(c) {
assert.ok(c.extensions);
assert.equal(c.extensions[0], "Foo=Bar");
assert.equal(c.extensions[1], "Baz");
}
},
"invalid expires": function() {
const c = Cookie.parse("a=b; Expires=xyzzy");
assert.ok(c);
assert.equal(c.expires, Infinity);
},
"zero max-age": function() {
const c = Cookie.parse("a=b; Max-Age=0");
assert.ok(c);
assert.equal(c.maxAge, 0);
},
"negative max-age": function() {
const c = Cookie.parse("a=b; Max-Age=-1");
assert.ok(c);
assert.equal(c.maxAge, -1);
},
"empty domain": function() {
const c = Cookie.parse("a=b; domain=");
assert.ok(c);
assert.equal(c.domain, null);
},
"dot domain": function() {
const c = Cookie.parse("a=b; domain=.");
assert.ok(c);
assert.equal(c.domain, null);
},
"uppercase domain": function() {
const c = Cookie.parse("a=b; domain=EXAMPLE.COM");
assert.ok(c);
assert.equal(c.domain, "example.com");
},
"trailing dot in domain": {
topic: function() {
return Cookie.parse("a=b; Domain=example.com.", true) || null;
},
"has the domain": function(c) {
assert.equal(c.domain, "example.com.");
},
"but doesn't validate": function(c) {
assert.equal(c.validate(), false);
}
},
"empty path": function() {
const c = Cookie.parse("a=b; path=");
assert.ok(c);
assert.equal(c.path, null);
},
"no-slash path": function() {
const c = Cookie.parse("a=b; path=xyzzy");
assert.ok(c);
assert.equal(c.path, null);
},
"trailing semi-colons after path": {
topic: function() {
return ["a=b; path=/;", "c=d;;;;"];
},
"strips semi-colons": function(t) {
const c1 = Cookie.parse(t[0]);
const c2 = Cookie.parse(t[1]);
assert.ok(c1);
assert.ok(c2);
assert.equal(c1.path, "/");
}
},
"secure-with-value": function() {
const c = Cookie.parse("a=b; Secure=xyzzy");
assert.ok(c);
assert.equal(c.secure, true);
},
"httponly-with-value": function() {
const c = Cookie.parse("a=b; HttpOnly=xyzzy");
assert.ok(c);
assert.equal(c.httpOnly, true);
},
garbage: {
topic: function() {
return Cookie.parse("\x08", true) || null;
},
"doesn't parse": function(c) {
assert.equal(c, null);
}
},
"public suffix domain": {
topic: function() {
return Cookie.parse("a=b; domain=kyoto.jp", true) || null;
},
"parses fine": function(c) {
assert.ok(c);
assert.equal(c.domain, "kyoto.jp");
},
"but fails validation": function(c) {
assert.ok(c);
assert.ok(!c.validate());
}
},
"public suffix foonet.net": {
"top level": {
topic: function() {
return Cookie.parse("a=b; domain=foonet.net") || null;
},
"parses and is valid": function(c) {
assert.ok(c);
assert.equal(c.domain, "foonet.net");
assert.ok(c.validate());
}
},
www: {
topic: function() {
return Cookie.parse("a=b; domain=www.foonet.net") || null;
},
"parses and is valid": function(c) {
assert.ok(c);
assert.equal(c.domain, "www.foonet.net");
assert.ok(c.validate());
}
},
"with a dot": {
topic: function() {
return Cookie.parse("a=b; domain=.foonet.net") || null;
},
"parses and is valid": function(c) {
assert.ok(c);
assert.equal(c.domain, "foonet.net");
assert.ok(c.validate());
}
}
},
"Ironically, Google 'GAPS' cookie has very little whitespace": {
topic: function() {
return Cookie.parse(
"GAPS=1:A1aaaaAaAAa1aaAaAaaAAAaaa1a11a:aaaAaAaAa-aaaA1-;Path=/;Expires=Thu, 17-Apr-2014 02:12:29 GMT;Secure;HttpOnly"
);
},
parsed: function(c) {
assert.ok(c);
},
key: function(c) {
assert.equal(c.key, "GAPS");
},
value: function(c) {
assert.equal(
c.value,
"1:A1aaaaAaAAa1aaAaAaaAAAaaa1a11a:aaaAaAaAa-aaaA1-"
);
},
path: function(c) {
assert.notEqual(c.path, "/;Expires"); // BUG
assert.equal(c.path, "/");
},
expires: function(c) {
assert.notEqual(c.expires, Infinity);
assert.equal(c.expires.getTime(), 1397700749000);
},
secure: function(c) {
assert.ok(c.secure);
},
httponly: function(c) {
assert.ok(c.httpOnly);
}
},
"lots of equal signs": {
topic: function() {
return Cookie.parse(
"queryPref=b=c&d=e; Path=/f=g; Expires=Thu, 17 Apr 2014 02:12:29 GMT; HttpOnly"
);
},
parsed: function(c) {
assert.ok(c);
},
key: function(c) {
assert.equal(c.key, "queryPref");
},
value: function(c) {
assert.equal(c.value, "b=c&d=e");
},
path: function(c) {
assert.equal(c.path, "/f=g");
},
expires: function(c) {
assert.notEqual(c.expires, Infinity);
assert.equal(c.expires.getTime(), 1397700749000);
},
httponly: function(c) {
assert.ok(c.httpOnly);
}
},
"spaces in value": {
topic: function() {
return Cookie.parse("a=one two three", false) || null;
},
parsed: function(c) {
assert.ok(c);
},
key: function(c) {
assert.equal(c.key, "a");
},
value: function(c) {
assert.equal(c.value, "one two three");
},
"no path": function(c) {
assert.equal(c.path, null);
},
"no domain": function(c) {
assert.equal(c.domain, null);
},
"no extensions": function(c) {
assert.ok(!c.extensions);
}
},
"quoted spaces in value": {
topic: function() {
return Cookie.parse('a="one two three"', false) || null;
},
parsed: function(c) {
assert.ok(c);
},
key: function(c) {
assert.equal(c.key, "a");
},
value: function(c) {
assert.equal(c.value, '"one two three"');
},
"no path": function(c) {
assert.equal(c.path, null);
},
"no domain": function(c) {
assert.equal(c.domain, null);
},
"no extensions": function(c) {
assert.ok(!c.extensions);
}
},
"non-ASCII in value": {
topic: function() {
return Cookie.parse("farbe=weiß", false) || null;
},
parsed: function(c) {
assert.ok(c);
},
key: function(c) {
assert.equal(c.key, "farbe");
},
value: function(c) {
assert.equal(c.value, "weiß");
},
"no path": function(c) {
assert.equal(c.path, null);
},
"no domain": function(c) {
assert.equal(c.domain, null);
},
"no extensions": function(c) {
assert.ok(!c.extensions);
}
},
"empty key": {
topic: function() {
return Cookie.parse("=abc", { loose: true }) || null;
},
parsed: function(c) {
assert.ok(c);
},
key: function(c) {
assert.equal(c.key, "");
},
value: function(c) {
assert.equal(c.value, "abc");
},
"no path": function(c) {
assert.equal(c.path, null);
},
"no domain": function(c) {
assert.equal(c.domain, null);
},
"no extensions": function(c) {
assert.ok(!c.extensions);
}
},
"non-existent key": {
topic: function() {
return Cookie.parse("abc", { loose: true }) || null;
},
parsed: function(c) {
assert.ok(c);
},
key: function(c) {
assert.equal(c.key, "");
},
value: function(c) {
assert.equal(c.value, "abc");
},
"no path": function(c) {
assert.equal(c.path, null);
},
"no domain": function(c) {
assert.equal(c.domain, null);
},
"no extensions": function(c) {
assert.ok(!c.extensions);
}
},
"weird format": {
topic: function() {
return Cookie.parse("=foo=bar", { loose: true }) || null;
},
parsed: function(c) {
assert.ok(c);
},
key: function(c) {
assert.equal(c.key, "foo");
},
value: function(c) {
assert.equal(c.value, "bar");
},
"no path": function(c) {
assert.equal(c.path, null);
},
"no domain": function(c) {
assert.equal(c.domain, null);
},
"no extensions": function(c) {
assert.ok(!c.extensions);
}
},
"way too many semicolons followed by non-semicolon": {
topic: function() {
// takes abnormally long due to semi-catastrophic regexp backtracking
const str = `foo=bar${LOTS_OF_SEMICOLONS} domain=example.com`;
return Cookie.parse(str) || null;
},
parsed: function(c) {
assert.ok(c);
},
key: function(c) {
assert.equal(c.key, "foo");
},
value: function(c) {
assert.equal(c.value, "bar");
},
"no path": function(c) {
assert.equal(c.path, null);
},
"no domain": function(c) {
assert.equal(c.domain, "example.com");
},
"no extensions": function(c) {
assert.ok(!c.extensions);
}
},
"way too many spaces": {
topic: function() {
// takes abnormally long due to semi-catastrophic regexp backtracking
const str1 = `x${LOTS_OF_SPACES}x`;
const str2 = "x x";
const t0 = Date.now();
const cookie1 = Cookie.parse(str1) || null;
const t1 = Date.now();
const cookie2 = Cookie.parse(str2) || null;
const t2 = Date.now();
return {
cookie1: cookie1,
cookie2: cookie2,
dt1: t1 - t0,
dt2: t2 - t1
};
},
"large one doesn't parse": function(c) {
assert.equal(c.cookie1, null);
},
"small one doesn't parse": function(c) {
assert.equal(c.cookie2, null);
},
"takes about the same time for each": function(c) {
const long1 = c.dt1 + 1; // avoid 0ms
const short2 = c.dt2 + 1; // avoid 0ms
const ratio = Math.abs(long1 / short2);
assert.lesser(ratio, 250); // if broken, goes 2000-4000x
}
},
"way too many spaces with value": {
topic: function() {
// takes abnormally long due to semi-catastrophic regexp backtracking
const str1 = `x${LOTS_OF_SPACES}=x`;
const str2 = "x =x";
const t0 = Date.now();
const cookie1 = Cookie.parse(str1) || null;
const t1 = Date.now();
const cookie2 = Cookie.parse(str2) || null;
const t2 = Date.now();
return {
cookie1: cookie1,
cookie2: cookie2,
dt1: t1 - t0,
dt2: t2 - t1
};
},
"large one parses": function(c) {
assert.ok(c.cookie1);
assert.equal(c.cookie1.key, "x");
assert.equal(c.cookie1.value, "x");
},
"small one parses": function(c) {
assert.ok(c.cookie2);
assert.equal(c.cookie2.key, "x");
assert.equal(c.cookie2.value, "x");
},
"takes about the same time for each": function(c) {
const long1 = c.dt1 + 1; // avoid 0ms
const short2 = c.dt2 + 1; // avoid 0ms
const ratio = Math.abs(long1 / short2);
assert.lesser(ratio, 250); // if broken, goes 2000-4000x
}
},
"way too many spaces in loose mode": {
topic: function() {
// takes abnormally long due to semi-catastrophic regexp backtracking
const str1 = `x${LOTS_OF_SPACES}x`;
const str2 = "x x";
const t0 = Date.now();
const cookie1 = Cookie.parse(str1, { loose: true }) || null;
const t1 = Date.now();
const cookie2 = Cookie.parse(str2, { loose: true }) || null;
const t2 = Date.now();
return {
cookie1: cookie1,
cookie2: cookie2,
dt1: t1 - t0,
dt2: t2 - t1
};
},
"large one parses": function(c) {
assert.ok(c.cookie1);
assert.equal(c.cookie1.key, "");
assert.equal(c.cookie1.value, `x${LOTS_OF_SPACES}x`);
},
"small one parses": function(c) {
assert.ok(c.cookie2);
assert.equal(c.cookie2.key, "");
assert.equal(c.cookie2.value, "x x");
},
"takes about the same time for each": function(c) {
const long1 = c.dt1 + 1; // avoid 0ms
const short2 = c.dt2 + 1; // avoid 0ms
const ratio = Math.abs(long1 / short2);
assert.lesser(ratio, 250); // if broken, goes 2000-4000x
}
},
"way too many spaces with value in loose mode": {
topic: function() {
// takes abnormally long due to semi-catastrophic regexp backtracking
const str1 = `x${LOTS_OF_SPACES}=x`;
const str2 = "x =x";
const t0 = Date.now();
const cookie1 = Cookie.parse(str1, { loose: true }) || null;
const t1 = Date.now();
const cookie2 = Cookie.parse(str2, { loose: true }) || null;
const t2 = Date.now();
return {
cookie1: cookie1,
cookie2: cookie2,
dt1: t1 - t0,
dt2: t2 - t1
};
},
"large one parses": function(c) {
assert.ok(c.cookie1);
assert.equal(c.cookie1.key, "x");
assert.equal(c.cookie1.value, "x");
},
"small one parses": function(c) {
assert.ok(c.cookie2);
assert.equal(c.cookie2.key, "x");
assert.equal(c.cookie2.value, "x");
},
"takes about the same time for each": function(c) {
const long1 = c.dt1 + 1; // avoid 0ms
const short2 = c.dt2 + 1; // avoid 0ms
const ratio = Math.abs(long1 / short2);
assert.lesser(ratio, 250); // if broken, goes 2000-4000x
}
},
"same-site": {
lax: {
topic: function() {
return Cookie.parse("abc=xyzzy; SameSite=Lax") || null;
},
parsed: function(c) {
assert.ok(c);
},
"is lax (lowercased)": function(c) {
assert.equal(c.sameSite, "lax");
},
"no extensions": function(c) {
assert.equal(c.extensions, null);
}
},
strict: {
topic: function() {
return Cookie.parse("abc=xyzzy; SameSite=StRiCt") || null;
},
parsed: function(c) {
assert.ok(c);
},
"is strict (lowercased)": function(c) {
assert.equal(c.sameSite, "strict");
},
"no extensions": function(c) {
assert.equal(c.extensions, null);
}
},
none: {
topic: function() {
return Cookie.parse("abc=xyz; SameSite=NoNe") || null;
},
parsed: function(c) {
assert.ok(c);
},
"is none (lowercased)": function(c) {
assert.equal(c.sameSite, "none");
},
"no extensions": function(c) {
assert.equal(c.extensions, null);
}
},
bad: {
topic: function() {
return Cookie.parse("abc=xyzzy; SameSite=example.com") || null;
},
parsed: function(c) {
assert.ok(c);
},
"is set to 'undefined'": function(c) {
assert.equal(c.sameSite, undefined);
},
"no extensions": function(c) {
assert.equal(c.extensions, null);
}
},
absent: {
topic: function() {
return Cookie.parse("abc=xyzzy;") || null;
},
parsed: function(c) {
assert.ok(c);
},
"is set to 'undefined'": function(c) {
assert.equal(c.sameSite, undefined);
},
"no extensions": function(c) {
assert.equal(c.extensions, null);
}
}
},
"empty string": {
topic: function() {
return Cookie.parse("");
},
"is empty": function(c) {
assert.isNull(c);
}
},
"missing string": {
topic: function() {
return Cookie.parse();
},
"is empty": function(c) {
assert.isNull(c);
}
},
"some string object": {
topic: function() {
return Cookie.parse(new String(""));
},
"is empty": function(c) {
assert.isNull(c, null);
}
},
"some empty string object": {
topic: function() {
return Cookie.parse(new String());
},
"is empty": function(c) {
assert.isNull(c, null);
}
}
})
.export(module);