| /* | |
| * Copyright (c) 2005, 2021, Oracle and/or its affiliates. All rights reserved. | |
| * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. | |
| * | |
| * This code is free software; you can redistribute it and/or modify it | |
| * under the terms of the GNU General Public License version 2 only, as | |
| * published by the Free Software Foundation. Oracle designates this | |
| * particular file as subject to the "Classpath" exception as provided | |
| * by Oracle in the LICENSE file that accompanied this code. | |
| * | |
| * This code is distributed in the hope that it will be useful, but WITHOUT | |
| * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or | |
| * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License | |
| * version 2 for more details (a copy is included in the LICENSE file that | |
| * accompanied this code). | |
| * | |
| * You should have received a copy of the GNU General Public License version | |
| * 2 along with this work; if not, write to the Free Software Foundation, | |
| * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. | |
| * | |
| * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA | |
| * or visit www.oracle.com if you need additional information or have any | |
| * questions. | |
| */ | |
| package java.net; | |
| import java.util.Map; | |
| import java.util.List; | |
| import java.util.Comparator; | |
| import java.io.IOException; | |
| import sun.util.logging.PlatformLogger; | |
| /** | |
| * CookieManager provides a concrete implementation of {@link CookieHandler}, | |
| * which separates the storage of cookies from the policy surrounding accepting | |
| * and rejecting cookies. A CookieManager is initialized with a {@link CookieStore} | |
| * which manages storage, and a {@link CookiePolicy} object, which makes | |
| * policy decisions on cookie acceptance/rejection. | |
| * | |
| * <p> The HTTP cookie management in java.net package looks like: | |
| * <blockquote> | |
| * <pre>{@code | |
| * use | |
| * CookieHandler <------- HttpURLConnection | |
| * ^ | |
| * | impl | |
| * | use | |
| * CookieManager -------> CookiePolicy | |
| * | use | |
| * |--------> HttpCookie | |
| * | ^ | |
| * | | use | |
| * | use | | |
| * |--------> CookieStore | |
| * ^ | |
| * | impl | |
| * | | |
| * Internal in-memory implementation | |
| * }</pre> | |
| * <ul> | |
| * <li> | |
| * CookieHandler is at the core of cookie management. User can call | |
| * CookieHandler.setDefault to set a concrete CookieHandler implementation | |
| * to be used. | |
| * </li> | |
| * <li> | |
| * CookiePolicy.shouldAccept will be called by CookieManager.put to see whether | |
| * or not one cookie should be accepted and put into cookie store. User can use | |
| * any of three pre-defined CookiePolicy, namely ACCEPT_ALL, ACCEPT_NONE and | |
| * ACCEPT_ORIGINAL_SERVER, or user can define his own CookiePolicy implementation | |
| * and tell CookieManager to use it. | |
| * </li> | |
| * <li> | |
| * CookieStore is the place where any accepted HTTP cookie is stored in. | |
| * If not specified when created, a CookieManager instance will use an internal | |
| * in-memory implementation. Or user can implements one and tell CookieManager | |
| * to use it. | |
| * </li> | |
| * <li> | |
| * Currently, only CookieStore.add(URI, HttpCookie) and CookieStore.get(URI) | |
| * are used by CookieManager. Others are for completeness and might be needed | |
| * by a more sophisticated CookieStore implementation, e.g. a NetscapeCookieStore. | |
| * </li> | |
| * </ul> | |
| * </blockquote> | |
| * | |
| * <p>There're various ways user can hook up his own HTTP cookie management behavior, e.g. | |
| * <blockquote> | |
| * <ul> | |
| * <li>Use CookieHandler.setDefault to set a brand new {@link CookieHandler} implementation | |
| * <li>Let CookieManager be the default {@link CookieHandler} implementation, | |
| * but implement user's own {@link CookieStore} and {@link CookiePolicy} | |
| * and tell default CookieManager to use them: | |
| * <blockquote><pre> | |
| * // this should be done at the beginning of an HTTP session | |
| * CookieHandler.setDefault(new CookieManager(new MyCookieStore(), new MyCookiePolicy())); | |
| * </pre></blockquote> | |
| * <li>Let CookieManager be the default {@link CookieHandler} implementation, but | |
| * use customized {@link CookiePolicy}: | |
| * <blockquote><pre> | |
| * // this should be done at the beginning of an HTTP session | |
| * CookieHandler.setDefault(new CookieManager()); | |
| * // this can be done at any point of an HTTP session | |
| * ((CookieManager)CookieHandler.getDefault()).setCookiePolicy(new MyCookiePolicy()); | |
| * </pre></blockquote> | |
| * </ul> | |
| * </blockquote> | |
| * | |
| * <p>The implementation conforms to <a href="http://www.ietf.org/rfc/rfc2965.txt">RFC 2965</a>, section 3.3. | |
| * | |
| * @spec https://www.rfc-editor.org/info/rfc2965 RFC 2965: HTTP State Management Mechanism | |
| * @see CookiePolicy | |
| * @author Edward Wang | |
| * @since 1.6 | |
| */ | |
| public class CookieManager extends CookieHandler | |
| { | |
| /* ---------------- Fields -------------- */ | |
| private CookiePolicy policyCallback; | |
| private CookieStore cookieJar = null; | |
| /* ---------------- Ctors -------------- */ | |
| /** | |
| * Create a new cookie manager. | |
| * | |
| * <p>This constructor will create new cookie manager with default | |
| * cookie store and accept policy. The effect is same as | |
| * {@code CookieManager(null, null)}. | |
| */ | |
| public CookieManager() { | |
| this(null, null); | |
| } | |
| /** | |
| * Create a new cookie manager with specified cookie store and cookie policy. | |
| * | |
| * @param store a {@code CookieStore} to be used by cookie manager. | |
| * if {@code null}, cookie manager will use a default one, | |
| * which is an in-memory CookieStore implementation. | |
| * @param cookiePolicy a {@code CookiePolicy} instance | |
| * to be used by cookie manager as policy callback. | |
| * if {@code null}, ACCEPT_ORIGINAL_SERVER will | |
| * be used. | |
| */ | |
| public CookieManager(CookieStore store, | |
| CookiePolicy cookiePolicy) | |
| { | |
| // use default cookie policy if not specify one | |
| policyCallback = (cookiePolicy == null) ? CookiePolicy.ACCEPT_ORIGINAL_SERVER | |
| : cookiePolicy; | |
| // if not specify CookieStore to use, use default one | |
| if (store == null) { | |
| cookieJar = new InMemoryCookieStore(); | |
| } else { | |
| cookieJar = store; | |
| } | |
| } | |
| /* ---------------- Public operations -------------- */ | |
| /** | |
| * To set the cookie policy of this cookie manager. | |
| * | |
| * <p> An instance of {@code CookieManager} will have | |
| * cookie policy ACCEPT_ORIGINAL_SERVER by default. Users always | |
| * can call this method to set another cookie policy. | |
| * | |
| * @param cookiePolicy the cookie policy. Can be {@code null}, which | |
| * has no effects on current cookie policy. | |
| */ | |
| public void setCookiePolicy(CookiePolicy cookiePolicy) { | |
| if (cookiePolicy != null) policyCallback = cookiePolicy; | |
| } | |
| /** | |
| * To retrieve current cookie store. | |
| * | |
| * @return the cookie store currently used by cookie manager. | |
| */ | |
| public CookieStore getCookieStore() { | |
| return cookieJar; | |
| } | |
| public Map<String, List<String>> | |
| get(URI uri, Map<String, List<String>> requestHeaders) | |
| throws IOException | |
| { | |
| // pre-condition check | |
| if (uri == null || requestHeaders == null) { | |
| throw new IllegalArgumentException("Argument is null"); | |
| } | |
| // if there's no default CookieStore, no way for us to get any cookie | |
| if (cookieJar == null) | |
| return Map.of(); | |
| boolean secureLink = "https".equalsIgnoreCase(uri.getScheme()); | |
| List<HttpCookie> cookies = new java.util.ArrayList<>(); | |
| String path = uri.getPath(); | |
| if (path == null || path.isEmpty()) { | |
| path = "/"; | |
| } | |
| for (HttpCookie cookie : cookieJar.get(uri)) { | |
| // apply path-matches rule (RFC 2965 sec. 3.3.4) | |
| // and check for the possible "secure" tag (i.e. don't send | |
| // 'secure' cookies over unsecure links) | |
| if (pathMatches(path, cookie.getPath()) && | |
| (secureLink || !cookie.getSecure())) { | |
| // Enforce httponly attribute | |
| if (cookie.isHttpOnly()) { | |
| String s = uri.getScheme(); | |
| if (!"http".equalsIgnoreCase(s) && !"https".equalsIgnoreCase(s)) { | |
| continue; | |
| } | |
| } | |
| // Let's check the authorize port list if it exists | |
| String ports = cookie.getPortlist(); | |
| if (ports != null && !ports.isEmpty()) { | |
| int port = uri.getPort(); | |
| if (port == -1) { | |
| port = "https".equals(uri.getScheme()) ? 443 : 80; | |
| } | |
| if (isInPortList(ports, port)) { | |
| cookies.add(cookie); | |
| } | |
| } else { | |
| cookies.add(cookie); | |
| } | |
| } | |
| } | |
| // apply sort rule (RFC 2965 sec. 3.3.4) | |
| List<String> cookieHeader = sortByPathAndAge(cookies); | |
| return Map.of("Cookie", cookieHeader); | |
| } | |
| public void | |
| put(URI uri, Map<String, List<String>> responseHeaders) | |
| throws IOException | |
| { | |
| // pre-condition check | |
| if (uri == null || responseHeaders == null) { | |
| throw new IllegalArgumentException("Argument is null"); | |
| } | |
| // if there's no default CookieStore, no need to remember any cookie | |
| if (cookieJar == null) | |
| return; | |
| PlatformLogger logger = PlatformLogger.getLogger("java.net.CookieManager"); | |
| for (String headerKey : responseHeaders.keySet()) { | |
| // RFC 2965 3.2.2, key must be 'Set-Cookie2' | |
| // we also accept 'Set-Cookie' here for backward compatibility | |
| if (headerKey == null | |
| || !(headerKey.equalsIgnoreCase("Set-Cookie2") | |
| || headerKey.equalsIgnoreCase("Set-Cookie") | |
| ) | |
| ) | |
| { | |
| continue; | |
| } | |
| for (String headerValue : responseHeaders.get(headerKey)) { | |
| try { | |
| List<HttpCookie> cookies; | |
| try { | |
| cookies = HttpCookie.parse(headerValue); | |
| } catch (IllegalArgumentException e) { | |
| // Bogus header, make an empty list and log the error | |
| cookies = java.util.Collections.emptyList(); | |
| if (logger.isLoggable(PlatformLogger.Level.SEVERE)) { | |
| logger.severe("Invalid cookie for " + uri + ": " + headerValue); | |
| } | |
| } | |
| for (HttpCookie cookie : cookies) { | |
| if (cookie.getPath() == null) { | |
| // If no path is specified, then by default | |
| // the path is the directory of the page/doc | |
| String path = uri.getPath(); | |
| if (!path.endsWith("/")) { | |
| int i = path.lastIndexOf('/'); | |
| if (i > 0) { | |
| path = path.substring(0, i + 1); | |
| } else { | |
| path = "/"; | |
| } | |
| } | |
| cookie.setPath(path); | |
| } | |
| // As per RFC 2965, section 3.3.1: | |
| // Domain Defaults to the effective request-host. (Note that because | |
| // there is no dot at the beginning of effective request-host, | |
| // the default Domain can only domain-match itself.) | |
| if (cookie.getDomain() == null) { | |
| String host = uri.getHost(); | |
| if (host != null && !host.contains(".")) | |
| host += ".local"; | |
| cookie.setDomain(host); | |
| } | |
| String ports = cookie.getPortlist(); | |
| if (ports != null) { | |
| int port = uri.getPort(); | |
| if (port == -1) { | |
| port = "https".equals(uri.getScheme()) ? 443 : 80; | |
| } | |
| if (ports.isEmpty()) { | |
| // Empty port list means this should be restricted | |
| // to the incoming URI port | |
| cookie.setPortlist("" + port ); | |
| if (shouldAcceptInternal(uri, cookie)) { | |
| cookieJar.add(uri, cookie); | |
| } | |
| } else { | |
| // Only store cookies with a port list | |
| // IF the URI port is in that list, as per | |
| // RFC 2965 section 3.3.2 | |
| if (isInPortList(ports, port) && | |
| shouldAcceptInternal(uri, cookie)) { | |
| cookieJar.add(uri, cookie); | |
| } | |
| } | |
| } else { | |
| if (shouldAcceptInternal(uri, cookie)) { | |
| cookieJar.add(uri, cookie); | |
| } | |
| } | |
| } | |
| } catch (IllegalArgumentException e) { | |
| // invalid set-cookie header string | |
| // no-op | |
| } | |
| } | |
| } | |
| } | |
| /* ---------------- Private operations -------------- */ | |
| // to determine whether or not accept this cookie | |
| private boolean shouldAcceptInternal(URI uri, HttpCookie cookie) { | |
| try { | |
| return policyCallback.shouldAccept(uri, cookie); | |
| } catch (Exception ignored) { // protect against malicious callback | |
| return false; | |
| } | |
| } | |
| private static boolean isInPortList(String lst, int port) { | |
| int i = lst.indexOf(','); | |
| int val = -1; | |
| while (i > 0) { | |
| try { | |
| val = Integer.parseInt(lst, 0, i, 10); | |
| if (val == port) { | |
| return true; | |
| } | |
| } catch (NumberFormatException numberFormatException) { | |
| } | |
| lst = lst.substring(i+1); | |
| i = lst.indexOf(','); | |
| } | |
| if (!lst.isEmpty()) { | |
| try { | |
| val = Integer.parseInt(lst); | |
| if (val == port) { | |
| return true; | |
| } | |
| } catch (NumberFormatException numberFormatException) { | |
| } | |
| } | |
| return false; | |
| } | |
| /* | |
| * path-matches algorithm, as defined by RFC 2965 | |
| */ | |
| private boolean pathMatches(String path, String pathToMatchWith) { | |
| if (path == pathToMatchWith) | |
| return true; | |
| if (path == null || pathToMatchWith == null) | |
| return false; | |
| if (path.startsWith(pathToMatchWith)) | |
| return true; | |
| return false; | |
| } | |
| /* | |
| * sort cookies with respect to their path and age: those with more longer Path attributes | |
| * precede those with shorter, as defined in RFC 6265. Cookies with the same length | |
| * path are distinguished by creation time (older first). Method made PP to enable testing. | |
| */ | |
| static List<String> sortByPathAndAge(List<HttpCookie> cookies) { | |
| cookies.sort(new CookieComparator()); | |
| List<String> cookieHeader = new java.util.ArrayList<>(); | |
| for (HttpCookie cookie : cookies) { | |
| // Netscape cookie spec and RFC 2965 have different format of Cookie | |
| // header; RFC 2965 requires a leading $Version="1" string while Netscape | |
| // does not. | |
| // The workaround here is to add a $Version="1" string in advance | |
| if (cookies.indexOf(cookie) == 0 && cookie.getVersion() > 0) { | |
| cookieHeader.add("$Version=\"1\""); | |
| } | |
| cookieHeader.add(cookie.toString()); | |
| } | |
| return cookieHeader; | |
| } | |
| // Comparator compares the length of the path. Longer paths should precede shorter ones. | |
| // As per rfc6265 cookies with equal path lengths sort on creation time. | |
| static class CookieComparator implements Comparator<HttpCookie> { | |
| public int compare(HttpCookie c1, HttpCookie c2) { | |
| if (c1 == c2) return 0; | |
| if (c1 == null) return -1; | |
| if (c2 == null) return 1; | |
| String p1 = c1.getPath(); | |
| String p2 = c2.getPath(); | |
| p1 = (p1 == null) ? "" : p1; | |
| p2 = (p2 == null) ? "" : p2; | |
| int len1 = p1.length(); | |
| int len2 = p2.length(); | |
| if (len1 > len2) | |
| return -1; | |
| if (len2 > len1) | |
| return 1; | |
| // Check creation time. Sort older first | |
| long creation1 = c1.getCreationTime(); | |
| long creation2 = c2.getCreationTime(); | |
| return Long.compare(creation1, creation2); | |
| } | |
| } | |
| } |