HTTPCookie: parse domain according to RFC

When the domain field is specified, the cookie is intended for the
domain and subdomains, so the value of domain has to be prefixed by a
dot.

Added tests to check for this behaviour and modified the incorrect
tests.

Author: drodriguez

Foundation/HTTPCookie.swift

@@ -445,7 +445,7 @@ open class HTTPCookie : NSObject {
 
     //Bake a cookie
     private class func createHttpCookie(url: URL, pairs: ArraySlice<String>) -> HTTPCookie? {
-        var properties: [HTTPCookiePropertyKey : Any] = [:]
+        var properties: [HTTPCookiePropertyKey : String] = [:]
         for pair in pairs {
             let name = pair.components(separatedBy: "=")[0]
             var value = pair.components(separatedBy: "\(name)=")[1]  //a value can have an "="
@@ -455,10 +455,22 @@ open class HTTPCookie : NSObject {
             properties[canonicalize(name)] = value
         }
 
-        // If domain wasn't provided, extract it from the URL
-        if properties[.domain] == nil {
+        if let domain = properties[.domain] {
+            // The provided domain string has to be prepended with a dot,
+            // because the domain field indicates that it can be sent
+            // subdomains of the domain (but only if it is not an IP address).
+            if (!domain.hasPrefix(".") && !isIPv4Address(domain)) {
+                properties[.domain] = ".\(domain)"
+            }
+        } else {
+            // If domain wasn't provided, extract it from the URL. No dots in
+            // this case, only exact matching.
             properties[.domain] = url.host
         }
+        // Always lowercase the domain.
+        if let domain = properties[.domain] {
+            properties[.domain] = domain.lowercased()
+        }
 
         //the default Path is "/"
         if properties[.path] == nil {
@@ -476,6 +488,11 @@ open class HTTPCookie : NSObject {
         return value
     }
 
+    private class func isIPv4Address(_ string: String) -> Bool {
+        var x = in_addr()
+        return inet_pton(AF_INET, string, &x) == 1
+    }
+
     //These cookie attributes are defined in RFC 6265 and 2965(which is obsolete)
     //HTTPCookie supports these
     private class func isCookieAttribute(_ string: String) -> Bool {

TestFoundation/TestHTTPCookie.swift

@@ -12,6 +12,7 @@ class TestHTTPCookie: XCTestCase {
     static var allTests: [(String, (TestHTTPCookie) -> () throws -> Void)] {
         return [
             ("test_BasicConstruction", test_BasicConstruction),
+            ("test_cookieDomainCanonicalization", test_cookieDomainCanonicalization),
             ("test_RequestHeaderFields", test_RequestHeaderFields),
             ("test_cookiesWithResponseHeader1cookie", test_cookiesWithResponseHeader1cookie),
             ("test_cookiesWithResponseHeader0cookies", test_cookiesWithResponseHeader0cookies),
@@ -171,6 +172,53 @@ class TestHTTPCookie: XCTestCase {
         XCTAssertEqual(cookies[0].path, "/")
     }
 
+    func test_cookieDomainCanonicalization() throws {
+        do {
+            let headers = [
+                "Set-Cookie": "PREF=a=b; expires=\(formattedCookieTime(sinceNow: 100))); path=/; domain=eXample.com"
+            ]
+            let cookies = HTTPCookie.cookies(withResponseHeaderFields: headers, for: try URL(string: "http://eXample.com").unwrapped())
+            XCTAssertEqual(cookies.count, 1)
+            XCTAssertEqual(cookies.first?.domain, ".example.com")
+        }
+
+        do {
+            let headers = [
+                "Set-Cookie": "PREF=a=b; expires=\(formattedCookieTime(sinceNow: 100))); path=/; domain=.eXample.com"
+            ]
+            let cookies = HTTPCookie.cookies(withResponseHeaderFields: headers, for: try URL(string: "http://eXample.com").unwrapped())
+            XCTAssertEqual(cookies.count, 1)
+            XCTAssertEqual(cookies.first?.domain, ".example.com")
+        }
+
+        do {
+            let headers = [
+                "Set-Cookie": "PREF=a=b; expires=\(formattedCookieTime(sinceNow: 100))); path=/; domain=a.eXample.com"
+            ]
+            let cookies = HTTPCookie.cookies(withResponseHeaderFields: headers, for: try URL(string: "http://a.eXample.com").unwrapped())
+            XCTAssertEqual(cookies.count, 1)
+            XCTAssertEqual(cookies.first?.domain, ".a.example.com")
+        }
+
+        do {
+            let headers = [
+                "Set-Cookie": "PREF=a=b; expires=\(formattedCookieTime(sinceNow: 100))); path=/"
+            ]
+            let cookies = HTTPCookie.cookies(withResponseHeaderFields: headers, for: try URL(string: "http://a.eXample.com").unwrapped())
+            XCTAssertEqual(cookies.count, 1)
+            XCTAssertEqual(cookies.first?.domain, "a.example.com")
+        }
+
+        do {
+            let headers = [
+                "Set-Cookie": "PREF=a=b; expires=\(formattedCookieTime(sinceNow: 100))); path=/; domain=1.2.3.4"
+            ]
+            let cookies = HTTPCookie.cookies(withResponseHeaderFields: headers, for: try URL(string: "http://eXample.com").unwrapped())
+            XCTAssertEqual(cookies.count, 1)
+            XCTAssertEqual(cookies.first?.domain, "1.2.3.4")
+        }
+    }
+
     func test_cookieExpiresDateFormats() {
         let testDate = Date(timeIntervalSince1970: 1577881800)
         let cookieString =
@@ -188,7 +236,7 @@ class TestHTTPCookie: XCTestCase {
         XCTAssertEqual(cookies.count, 3)
         cookies.forEach { cookie in
             XCTAssertEqual(cookie.expiresDate, testDate)
-            XCTAssertEqual(cookie.domain, "swift.org")
+            XCTAssertEqual(cookie.domain, ".swift.org")
             XCTAssertEqual(cookie.path, "/")
         }
     }
@@ -201,4 +249,11 @@ class TestHTTPCookie: XCTestCase {
             XCTFail("Unable to create cookie with substring")
         }
     }
+
+    private func formattedCookieTime(sinceNow seconds: TimeInterval) -> String {
+        let f = DateFormatter()
+        f.timeZone = TimeZone(abbreviation: "GMT")
+        f.dateFormat = "EEEE',' dd'-'MMM'-'yy HH':'mm':'ss z"
+        return f.string(from: Date(timeIntervalSinceNow: seconds))
+    }
 }