if (NS_SUCCEEDED(rv))
if (NS_FAILED(rv))
cookie_SetCookieString(nsIURI * curURL, nsIPrompt *aPrompter, const char * setCookieHeader,                       time_t timeToExpire, nsIHttpChannel* aHttpChannel, nsCookieStatus status) {  cookie_CookieStruct * prev_cookie;  char *path_from_header=nsnull, *host_from_header=nsnull;  char *name_from_header=nsnull, *cookie_from_header=nsnull;  nsCAutoString cur_host, cur_path;  nsresult rv;  rv = curURL->GetHost(cur_host);  if (NS_FAILED(rv)) {#if defined(PR_LOGGING)    cookie_LogFailure(SET_COOKIE, curURL, setCookieHeader, "GetHost failed");#endif    return;  }  /* Don't let ftp sites set cookies (could be a security issue) */  PRBool isFtp;  if (NS_FAILED(curURL->SchemeIs("ftp", &isFtp)) || isFtp) {#if defined(PR_LOGGING)    cookie_LogFailure(SET_COOKIE, curURL, setCookieHeader, "ftp sites cannot set cookies");#endif    return;  }  rv = curURL->GetPath(cur_path);  if (NS_FAILED(rv)) {#if defined(PR_LOGGING)    cookie_LogFailure(SET_COOKIE, curURL, setCookieHeader, "GetPath failed");#endif    return;  }  char *semi_colon, *ptr, *equal;  PRBool isSecure=PR_FALSE, isDomain=PR_FALSE;  PRBool pref_scd = PR_FALSE;  /* Only allow cookies to be set in the listed contexts.   * We don't want cookies being set in html mail.    *//* We need to come back and work on this - Neeti   type = context->type;  if(!((type==MWContextBrowser) || (type==MWContextHTMLHelp) || (type==MWContextPane))) {    PR_Free(cur_path);    PR_Free(cur_host);    return;  }*/  if(cookie_GetBehaviorPref() == PERMISSION_DontUse) {#if defined(PR_LOGGING)    cookie_LogFailure(SET_COOKIE, curURL, setCookieHeader, "Cookies are disabled");#endif    return;  }//printf("\nSetCookieString(URL '%s', header '%s') time %d == %s\n",curURL,setCookieHeader,timeToExpire,asctime(gmtime(&timeToExpire)));  if(cookie_GetLifetimePref() == COOKIE_Discard) {    if(cookie_GetLifetimeTime() < timeToExpire) {#if defined(PR_LOGGING)      cookie_LogFailure(SET_COOKIE, curURL, setCookieHeader, "Cookie lifetime test failed");#endif      return;    }  }//HG87358 -- @@??  /* terminate at any carriage return or linefeed */  char *setCookieHeaderInternal = nsCRT::strdup(setCookieHeader);  for(ptr=setCookieHeaderInternal; *ptr; ptr++) {    if(*ptr == nsCRT::LF || *ptr == nsCRT::CR) {      *ptr = '\0';      break;    }  }  /* parse path and expires attributes from header if present */  semi_colon = PL_strchr(setCookieHeaderInternal, ';');  if(semi_colon) {    /* truncate at semi-colon and advance */    *semi_colon++ = '\0';    /* look for the secure attribute */    // Note the following will consider the cookie as secure if the set-cookie header    // in in either of the following two forms:    //   secure;  -- this is the correct syntax according to the cookie spec    //   secure=<anything>; -- this violates the spec but is accepted by IE    // This means that things like "secure=yes", "secure=true", etc will set the    // secure attribute.  But so will things like "secure=no", "secure=false", etc.    // Seems like the wrong thing to do, but this is indeed what IE does, so we might    // break some sites if we don't do the same.  In any event, any site that has    // an equal sign is in violation of the spec so whatever we do to them is fair game.    char * ptr;    static const char secureToken[] = "secure";    ptr = PL_strcasestr(semi_colon, secureToken);    while (ptr) {      char * ptr2 = ptr + sizeof(secureToken) -1; // -1 for the null terminator      // make sure nothing follows "secure" except for equal sign or semicolon      while (*ptr2 == ' ' || *ptr2 == '\t') { // skip over trailing whitespace        ptr2++;      }      if (*ptr2 == ';' || *ptr2 == '=' || *ptr2 == '\0') {        // make sure nothing precedes "secure" except for ';'        ptr--;        while (*ptr == ' ' || *ptr == '\t') { // skip over leading whitespace          ptr--;        }        if (*ptr == ';' || *ptr == '\0') { // note: '\0' means we got to beginning of string          isSecure = PR_TRUE;          break;        }      }      ptr = PL_strcasestr(ptr2, "secure");    }    /* look for the path attribute */    ptr = PL_strcasestr(semi_colon, "path=");    if(ptr) {      nsCAutoString path(ptr+5);      path.Trim(kWhitespace);      CKutil_StrAllocCopy(path_from_header, path.get());      /* terminate at first space or semi-colon */      for(ptr=path_from_header; *ptr != '\0'; ptr++) {        if(nsString::IsSpace(*ptr) || *ptr == ';' || *ptr == ',') {          *ptr = '\0';          break;        }      }    }    /* look for the URI or URL attribute     *     * This might be a security hole so I'm removing     * it for now.     */    /* look for a domain */    ptr = PL_strcasestr(semi_colon, "domain=");    if(ptr) {      ptr += 7; // get past the "domain="      char *domain_from_header=nsnull;      char *dot;      int domain_length, cur_host_length;      /* remove leading spaces, else the dot-forcing below will put a dot before the space */      while (nsString::IsSpace(*ptr)) {        ptr++;      }      /* allocate more than we need */      nsCAutoString domain;      if (*ptr != '.' && !cookie_IsIPAddress(cur_host.get())) {        // if host is not an IP address, force domain name to start with a dot        domain = '.';      }      domain.Append(ptr);      domain.Trim(kWhitespace);      CKutil_StrAllocCopy(domain_from_header, domain.get());      /* terminate at first space or semi-colon */      for(ptr=domain_from_header; *ptr != '\0'; ptr++) {        if(nsString::IsSpace(*ptr) || *ptr == ';' || *ptr == ',') {          *ptr = '\0';          break;        }      }      /* verify that this host has the authority to set for this domain.   We do       * this by making sure that the host is in the domain.  We also require       * that a domain have at least two periods to prevent domains of the form       * ".com" and ".edu"       *       * Also make sure that there is more stuff after       * the second dot to prevent ".com."       */      dot = PL_strchr(domain_from_header, '.');      if(dot) {        dot = PL_strchr(dot+1, '.');      }      if(!dot || *(dot+1) == '\0') {        /* did not pass two dot test. FAIL */        PR_FREEIF(path_from_header);        PR_Free(domain_from_header);        // TRACEMSG(("DOMAIN failed two dot test"));        nsCRT::free(setCookieHeaderInternal);#if defined(PR_LOGGING)        cookie_LogFailure(SET_COOKIE, curURL, setCookieHeader, "Failed the two-dot test");#endif        return;      }      domain_length   = PL_strlen(domain_from_header);      cur_host_length = PL_strlen(cur_host.get());      /* check to see if the host is in the domain */      if (!cookie_IsInDomain(domain_from_header, (char*)cur_host.get())) {          // TRACEMSG(("DOMAIN failed host within domain test."//        " Domain: %s, Host: %s", domain_from_header, cur_host));        PR_FREEIF(path_from_header);        PR_Free(domain_from_header);        nsCRT::free(setCookieHeaderInternal);#if defined(PR_LOGGING)        cookie_LogFailure(SET_COOKIE, curURL, setCookieHeader, "Host is not in the domain");#endif        return;      }      /*       * check that portion of host not in domain does not contain a dot       *    This satisfies the fourth requirement in section 4.3.2 of the cookie       *    spec rfc 2109 (see www.cis.ohio-state.edu/htbin/rfc/rfc2109.html).       *    It prevents host of the form x.y.co.nz from setting cookies in the       *    entire .co.nz domain.  Note that this doesn't really solve the problem,       *    it justs makes it more unlikely.  Sites such as y.co.nz can still set       *    cookies for the entire .co.nz domain.       */      /*       *  Although this is the right thing to do(tm), it breaks too many sites.         *  So only do it if the restrictCookieDomains pref is PR_TRUE.       *       */      nsresult rv;      nsCOMPtr<nsIPref> prefs(do_GetService(NS_PREF_CONTRACTID, &rv));      if (!prefs || NS_FAILED(prefs->GetBoolPref(cookie_strictDomainsPref, &pref_scd))) {        pref_scd = PR_FALSE;      }      if ( pref_scd == PR_TRUE ) {        cur_host.SetCharAt(cur_host_length-domain_length, '\0');        dot = (char *)strchr(cur_host.get(), '.');        cur_host.SetCharAt(cur_host_length-domain_length, '.');        if (dot) {        // TRACEMSG(("host minus domain failed no-dot test."        //  " Domain: %s, Host: %s", domain_from_header, cur_host));          PR_FREEIF(path_from_header);          PR_Free(domain_from_header);          nsCRT::free(setCookieHeaderInternal);#if defined(PR_LOGGING)          cookie_LogFailure(SET_COOKIE, curURL, setCookieHeader, "Host minus domain failed the no-dot test");#endif          return;        }      }      /* all tests passed, copy in domain to hostname field */      CKutil_StrAllocCopy(host_from_header, domain_from_header);      isDomain = PR_TRUE;      // TRACEMSG(("Accepted domain: %s", host_from_header));      PR_Free(domain_from_header);    }  }  /* set path if none found in header, else verify that host has authority for indicated path */  if(!path_from_header) {    /* Strip down everything after the last slash to get the path,     * ignoring slashes in the query string part.     */    char * iter = PL_strchr(cur_path.get(), '?');    if(iter) {      *iter = '\0';    }    iter = PL_strrchr(cur_path.get(), '/');    if(iter) {      *(iter+1) = '\0';    }    path_from_header = nsCRT::strdup(cur_path.get());#if 0  } else {    /*     * The following test is part of the RFC2109 spec.  Loosely speaking, it says that a site     * cannot set a cookie for a path that it is not on.  See bug 155083.  However this patch     * broke several sites -- nordea (bug 155768) and citibank (bug 156725).  So this test is being     * bracketed by an if statement to allow it to be disabled in the event that we cannot     * evangelize these sites.     */    if(PL_strncmp(cur_path.get(), path_from_header, PL_strlen(path_from_header))) {      PR_FREEIF(path_from_header);      PR_FREEIF(host_from_header);      nsCRT::free(setCookieHeaderInternal);#if defined(PR_LOGGING)      cookie_LogFailure(SET_COOKIE, curURL, setCookieHeader, "Failed the path test");#endif      return;    }#endif  }  if(!host_from_header) {    host_from_header = nsCRT::strdup(cur_host.get());  }  /* keep cookies under the max bytes limit */  if(PL_strlen(setCookieHeaderInternal) > MAX_BYTES_PER_COOKIE) {    setCookieHeaderInternal[MAX_BYTES_PER_COOKIE-1] = '\0';  }  /* separate the name from the cookie */  equal = PL_strchr(setCookieHeaderInternal, '=');  if (equal)      *equal = '\0';  nsCAutoString cookieHeader(setCookieHeaderInternal);  cookieHeader.Trim(kWhitespace);  if(equal) {    CKutil_StrAllocCopy(name_from_header, cookieHeader.get());    nsCAutoString value(equal+1);    value.Trim(kWhitespace);    CKutil_StrAllocCopy(cookie_from_header, value.get());  } else {    CKutil_StrAllocCopy(cookie_from_header, cookieHeader.get());    CKutil_StrAllocCopy(name_from_header, "");  }  int count = cookie_Count(host_from_header);  prev_cookie = cookie_CheckForPrevCookie    (path_from_header, host_from_header, name_from_header);  //TRACEMSG(("mkaccess.c: Setting cookie: %s for host: %s for path: %s",  //          cookie_from_header, host_from_header, path_from_header));    /* use common code to determine if we can set the cookie */  PRBool permission = PR_TRUE;  if (NS_SUCCEEDED(PERMISSION_Read())) {    PRBool modify = prev_cookie != nsnull;    // put the cookie information into the cookie structure.    nsCOMPtr<nsICookie> thisCookie =       new nsCookie(nsDependentCString(name_from_header),                   nsDependentCString(cookie_from_header),                   isDomain,                   nsDependentCString(host_from_header),                   nsDependentCString(path_from_header),                   isSecure,                   cookie_TrimLifetime(timeToExpire),                   status,                   cookie_GetPolicy(P3P_SitePolicy(curURL, aHttpChannel)));    permission = Permission_Check(aPrompter, host_from_header, COOKIEPERMISSION,// I believe this is the right place to eventually add the logic to ask// about cookies that have excessive lifetimes, but it shouldn't be done// until generalized per-site preferences are available.                                       //cookie_GetLifetimeAsk(timeToExpire) ||                                       cookie_GetWarningPref(),                                       thisCookie,                                       count, modify);  }  if (!permission) {    PR_FREEIF(path_from_header);    PR_FREEIF(host_from_header);    PR_FREEIF(name_from_header);    PR_FREEIF(cookie_from_header);    nsCRT::free(setCookieHeaderInternal);#if defined(PR_LOGGING)    cookie_LogFailure(SET_COOKIE, curURL, setCookieHeader, "Cookies blocked for this site");#endif    return;  }  nsCRT::free(setCookieHeaderInternal);  rv = COOKIE_AddCookie(host_from_header, path_from_header,                        name_from_header, cookie_from_header,                        isSecure, isDomain, timeToExpire,                        status,                        cookie_GetPolicy(P3P_SitePolicy(curURL, aHttpChannel)));#if defined(PR_LOGGING)  if (NS_SUCCEEDED(rv))    cookie_LogFailure(SET_COOKIE, curURL, setCookieHeader, "cookie_add failed");  else {    cookie_CookieStruct logCookie; // temporary for logging purposes    logCookie.path = path_from_header;    logCookie.host = host_from_header;    logCookie.name = name_from_header;    logCookie.cookie = cookie_from_header;    logCookie.expires = timeToExpire;    logCookie.lastAccessed = get_current_time();    logCookie.isSecure = isSecure;    logCookie.isDomain = isDomain;    logCookie.status = status;    logCookie.policy = nsICookie::POLICY_UNKNOWN; // unused in log    cookie_LogSuccess(SET_COOKIE, curURL, setCookieHeader, &logCookie);  }#endif}