cur_host[cur_host_length-domain_length] = '\0'; dot = XP_STRCHR(cur_host, '.'); cur_host[cur_host_length-domain_length] = '.'; if (dot) { TRACEMSG(("host minus domain failed no-dot test." " Domain: %s, Host: %s", domain_from_header, cur_host)); PR_Free(domain_from_header); PR_Free(cur_path); PR_Free(cur_host); #if defined(CookieManagement) net_IntSetCookieStringInUse = FALSE; net_UndeferCookies(); #endif return; }
net_IntSetCookieString(MWContext * context,					char * cur_url,					char * set_cookie_header,					time_t timeToExpire ){	net_CookieStruct * prev_cookie;	char *path_from_header=NULL, *host_from_header=NULL;	char *host_from_header2=NULL;	char *name_from_header=NULL, *cookie_from_header=NULL;	time_t expires=0;	char *cur_path = NET_ParseURL(cur_url, GET_PATH_PART);	char *cur_host = NET_ParseURL(cur_url, GET_HOST_PART);	char *semi_colon, *ptr, *equal;	const char *script_name;	PRBool HG83744 is_domain=FALSE, ask=FALSE, accept=FALSE;	MWContextType type;	Bool bCookieAdded;	if(!context) {		PR_Free(cur_path);		PR_Free(cur_host);		return;	}	/* Only allow cookies to be set in the listed contexts. We	 * don't want cookies being set in html mail. 	 */	type = context->type;	if(!( (type == MWContextBrowser)		|| (type == MWContextHTMLHelp)		|| (type == MWContextPane) )) {		PR_Free(cur_path);		PR_Free(cur_host);		return;	}		if(NET_GetCookieBehaviorPref() == NET_DontUse) {		PR_Free(cur_path);		PR_Free(cur_host);		return;	}#if defined(CookieManagement)	/* Don't enter this routine if it is already in use by another	   thread.  Otherwise the "remember this decision" result of the	   other cookie (which came first) won't get applied to this cookie.	 */	if (net_IntSetCookieStringInUse) {		PR_Free(cur_path);		PR_Free(cur_host);		net_DeferCookie(context, cur_url, set_cookie_header, timeToExpire);		return;	}	net_IntSetCookieStringInUse = TRUE;#endif	HG87358	/* terminate at any carriage return or linefeed */	for(ptr=set_cookie_header; *ptr; ptr++)		if(*ptr == LF || *ptr == CR) {			*ptr = '\0';			break;		}	/* parse path and expires attributes from header if 	 * present	 */	semi_colon = PL_strchr(set_cookie_header, ';');	if(semi_colon)	  {		/* truncate at semi-colon and advance 		 */		*semi_colon++ = '\0';		/* there must be some attributes. (hopefully)		 */		HG83476		/* look for the path attribute		 */		ptr = PL_strcasestr(semi_colon, "path=");		if(ptr) {			/* allocate more than we need */			StrAllocCopy(path_from_header, XP_StripLine(ptr+5));			/* terminate at first space or semi-colon			 */			for(ptr=path_from_header; *ptr != '\0'; ptr++)				if(NET_IS_SPACE(*ptr) || *ptr == ';' || *ptr == ',') {					*ptr = '\0';					break;				  }		  }		/* look for the URI or URL attribute		 *		 * This might be a security hole so I'm removing		 * it for now.		 */		/* look for a domain */        ptr = PL_strcasestr(semi_colon, "domain=");        if(ptr) {			char *domain_from_header=NULL;			char *dot, *colon;			int domain_length, cur_host_length;            /* allocate more than we need */			StrAllocCopy(domain_from_header, XP_StripLine(ptr+7));            /* terminate at first space or semi-colon             */            for(ptr=domain_from_header; *ptr != '\0'; ptr++)                if(NET_IS_SPACE(*ptr) || *ptr == ';' || *ptr == ',') {                    *ptr = '\0';                    break;                  }            /* verify that this host has the authority to set for             * this domain.   We do this by making sure that the             * host is in the domain             * We also require that a domain have at least two             * periods to prevent domains of the form ".com"             * and ".edu"			 *			 * Also make sure that there is more stuff after			 * the second dot to prevent ".com."             */            dot = PL_strchr(domain_from_header, '.');			if(dot)                dot = PL_strchr(dot+1, '.');			if(!dot || *(dot+1) == '\0') {				/* did not pass two dot test. FAIL				 */				PR_Free(domain_from_header);				PR_Free(cur_path);				PR_Free(cur_host);				TRACEMSG(("DOMAIN failed two dot test"));#if defined(CookieManagement)				net_IntSetCookieStringInUse = FALSE;				net_UndeferCookies();#endif				return;			  }			/* strip port numbers from the current host			 * for the domain test			 */			colon = PL_strchr(cur_host, ':');			if(colon)			   *colon = '\0';			domain_length   = PL_strlen(domain_from_header);			cur_host_length = PL_strlen(cur_host);			/* check to see if the host is in the domain			 */			if(domain_length > cur_host_length				|| PL_strcasecmp(domain_from_header, 							   &cur_host[cur_host_length-domain_length]))			  {				TRACEMSG(("DOMAIN failed host within domain test."					  " Domain: %s, Host: %s", domain_from_header, cur_host));				PR_Free(domain_from_header);				PR_Free(cur_path);				PR_Free(cur_host);#if defined(CookieManagement)				net_IntSetCookieStringInUse = FALSE;				net_UndeferCookies();#endif				return;              }			/* all tests passed, copy in domain to hostname field			 */			StrAllocCopy(host_from_header, domain_from_header);			is_domain = TRUE;			TRACEMSG(("Accepted domain: %s", host_from_header));			PR_Free(domain_from_header);          }		/* now search for the expires header 		 * NOTE: that this part of the parsing		 * destroys the original part of the string		 */		ptr = PL_strcasestr(semi_colon, "expires=");		if(ptr) {			char *date =  ptr+8;			/* terminate the string at the next semi-colon			 */			for(ptr=date; *ptr != '\0'; ptr++)				if(*ptr == ';') {					*ptr = '\0';					break;				  }			if(timeToExpire)				expires = timeToExpire;			else				expires = NET_ParseDate(date);			TRACEMSG(("Have expires date: %ld", expires));		  }	  }	if(!path_from_header) {        /* strip down everything after the last slash         * to get the path.         */        char * slash = PL_strrchr(cur_path, '/');        if(slash)            *slash = '\0';		path_from_header = cur_path;	  } else {		PR_Free(cur_path);	  }	if(!host_from_header)		host_from_header = cur_host;	else		PR_Free(cur_host);	/* keep cookies under the max bytes limit */	if(PL_strlen(set_cookie_header) > MAX_BYTES_PER_COOKIE)		set_cookie_header[MAX_BYTES_PER_COOKIE-1] = '\0';	/* separate the name from the cookie */	equal = PL_strchr(set_cookie_header, '=');	if(equal) {		*equal = '\0';		StrAllocCopy(name_from_header, XP_StripLine(set_cookie_header));		StrAllocCopy(cookie_from_header, XP_StripLine(equal+1));	  } else {		TRACEMSG(("Warning: no name found for cookie"));		StrAllocCopy(cookie_from_header, XP_StripLine(set_cookie_header));		StrAllocCopy(name_from_header, "");	  }    /* If there's a script, call it now */    script_name = NET_GetCookieScriptPref();    if( (const char *)0 != script_name ) {        JSCFCookieData *cd;        Bool changed = FALSE;        JSCFResult result;        cd = PR_NEWZAP(JSCFCookieData);        if( (JSCFCookieData *)0 == cd ) {            PR_FREEIF(path_from_header);            PR_FREEIF(host_from_header);            PR_FREEIF(name_from_header);            PR_FREEIF(cookie_from_header);            /* FREEIF(cur_path); */            /* FREEIF(cur_host); */#if defined(CookieManagement)            net_IntSetCookieStringInUse = FALSE;            net_UndeferCookies();#endif            return;        }        cd->path_from_header = path_from_header;        cd->host_from_header = host_from_header;        cd->name_from_header = name_from_header;        cd->cookie_from_header = cookie_from_header;        cd->expires = expires;        cd->url = cur_url;        HG84777        cd->domain = is_domain;        cd->prompt = NET_GetCookieWarningPref();        cd->preference = NET_GetCookieBehaviorPref();	/*	 * This is only safe to do from the mozilla thread	 *   since it might do file I/O and uses the preferences	 *   global context + objects.	 */#if !defined(MODULAR_NETLIB)        result= (JSCFResult)ET_JSCFExecute(context, script_name, cd, &changed);#else        /* XXX:  This is probably not correct, but it will fix the build for now... */        result= JSCF_Execute(context, script_name, cd, &changed);#endif /* MODULAR_NETLIB */		if( result != JSCF_error) {			if( changed ) {				if( cd->path_from_header != path_from_header ) {					PR_FREEIF(path_from_header);					path_from_header = PL_strdup(cd->path_from_header);				}				if( cd->host_from_header != host_from_header ) {					PR_FREEIF(host_from_header);					host_from_header = PL_strdup(cd->host_from_header);				}				if( cd->name_from_header != name_from_header ) {					PR_FREEIF(name_from_header);					name_from_header = PL_strdup(cd->name_from_header);				}				if( cd->cookie_from_header != cookie_from_header ) {					PR_FREEIF(cookie_from_header);				  cookie_from_header = PL_strdup(cd->cookie_from_header);			  }			  if( cd->expires != expires )				  expires = cd->expires;			  if( cd->domain != is_domain )				  /* lets hope the luser remembered to change the domain field */				  is_domain = cd->domain;			  HG27398			}			switch( result ) {				case JSCF_reject:					PR_FREEIF(path_from_header);					PR_FREEIF(host_from_header);					PR_FREEIF(name_from_header);					PR_FREEIF(cookie_from_header);					PR_Free(cd);					/* FREEIF(cur_path); */					/* FREEIF(cur_host); */#if defined(CookieManagement)					net_IntSetCookieStringInUse = FALSE;					net_UndeferCookies();#endif					return;				case JSCF_accept:					accept=TRUE;				case JSCF_error:				case JSCF_ask:					ask=TRUE;				case JSCF_whatever:				break;			}		}		PR_Free(cd);#if defined(CookieManagement)    } else {	net_CookiePermissionStruct * cookie_permission;	cookie_permission = net_CheckForCookiePermission(host_from_header);	if (cookie_permission != NULL) {	    if (cookie_permission->permission == FALSE) {		PR_FREEIF(path_from_header);		PR_FREEIF(host_from_header);		PR_FREEIF(name_from_header);		PR_FREEIF(cookie_from_header);		net_IntSetCookieStringInUse = FALSE;		net_UndeferCookies();		return;	    } else {		accept = TRUE;            }	}#endif    } 	if( (NET_GetCookieWarningPref() || ask) && !accept ) {		/* the user wants to know about cookies so let them		 * know about every one that is set and give them		 * the choice to accept it or not		 */		char * new_string=0;#if defined(CookieManagement)		int count;		char * remember_string = 0;		StrAllocCopy		    (remember_string, XP_GetString(MK_ACCESS_COOKIES_REMEMBER));		/* find out how many cookies this host has already set */		count = net_CookieCount(host_from_header);		net_lock_cookie_list();		prev_cookie = net_CheckForPrevCookie			(path_from_header, host_from_header, name_from_header);		net_unlock_cookie_list();		if (prev_cookie) {		    new_string = PR_smprintf(			XP_GetString(MK_ACCESS_COOKIES_WISHES_MODIFY),			host_from_header ? host_from_header : "");		} else if (count>1) {		    new_string = PR_smprintf(			XP_GetString(MK_ACCESS_COOKIES_WISHESN),			host_from_header ? host_from_header : "",			count);		} else if (count==1){		    new_string = PR_smprintf(			XP_GetString(MK_ACCESS_COOKIES_WISHES1),			host_from_header ? host_from_header : "");		} else {		    new_string = PR_smprintf(			XP_GetString(MK_ACCESS_COOKIES_WISHES0),			host_from_header ? host_from_header : "");		}#else		char * tmp_host = NET_ParseURL(cur_url, GET_HOST_PART);		StrAllocCopy(new_string, XP_GetString(MK_ACCESS_COOKIES_THE_SERVER));		StrAllocCat(new_string, tmp_host ? tmp_host : "");		StrAllocCat(new_string, XP_GetString(MK_ACCESS_COOKIES_WISHES));		PR_Free(tmp_host);		if(is_domain) {			StrAllocCat(new_string, XP_GetString(MK_ACCESS_COOKIES_TOANYSERV));			StrAllocCat(new_string, host_from_header);		  } else {			StrAllocCat(new_string, XP_GetString(MK_ACCESS_COOKIES_TOSELF));		  }		StrAllocCat(new_string, XP_GetString(MK_ACCESS_COOKIES_NAME_AND_VAL));		StrAllocCat(new_string, name_from_header);		StrAllocCat(new_string, "=");		StrAllocCat(new_string, cookie_from_header);		StrAllocCat(new_string, "\n");		if(expires) {			StrAllocCat(new_string, XP_GetString(MK_ACCESS_COOKIES_COOKIE_WILL_PERSIST));			StrAllocCat(new_string, ctime(&expires));		  }		StrAllocCat(new_string, XP_GetString(MK_ACCESS_COOKIES_SET_IT));#endif		/* 		 * Who knows what thread we are on.  Only the mozilla thread		 *   is allowed to post dialogs so, if need be, go over there		 */#if defined(CookieManagement)	    {		Bool old_cookie_remember_checked = cookie_remember_checked;		XP_Bool userHasAccepted = ET_PostCheckConfirmBox		    (context,		     new_string,		     remember_string,		     0,0,		     &cookie_remember_checked);		PR_FREEIF(new_string);		PR_FREEIF(remember_string);		if (cookie_remember_checked) {                    net_CookiePermissionStruct * cookie_permission;                    cookie_permission = PR_NEW(net_CookiePermissionStruct);                    if (cookie_permission) {                        net_lock_cookie_permission_list();                        StrAllocCopy(host_from_header2, host_from_header);                        /* ignore leading periods in host name */                        while (host_from_header2 && (*host_from_header2 == '.')) {                            host_from_header2++;                        }                        cookie_permission->host = host_from_header2; /* set host string */                        cookie_permission->permission = userHasAccepted;#ifdef TRUST_LABELS                        cookie_permission->TrustList = NULL;#endif                        net_AddCookiePermission(cookie_permission, TRUE);                        net_unlock_cookie_permission_list();                    }                }		if (old_cookie_remember_checked != cookie_remember_checked) {		    cookie_permissions_changed = TRUE;		    net_SaveCookiePermissions(NULL);		}		if (!userHasAccepted) {#if defined(CookieManagement)			net_IntSetCookieStringInUse = FALSE;			net_UndeferCookies();#endif			return;		}	    }#else		if(!ET_PostMessageBox(context, new_string, TRUE)) {			PR_FREEIF(new_string);			return;		}		PR_FREEIF(new_string);#endif	  }	TRACEMSG(("mkaccess.c: Setting cookie: %s for host: %s for path: %s",					cookie_from_header, host_from_header, path_from_header));	/* 	 * We have decided we are going to insert a cookie into the list	 *   Get the cookie lock so that we can munge on the list	 */	net_lock_cookie_list();	/* limit the number of cookies from a specific host or domain */	net_CheckForMaxCookiesFromHost(host_from_header);	if(XP_ListCount(net_cookie_list) > MAX_NUMBER_OF_COOKIES-1)		net_remove_oldest_cookie();    prev_cookie = net_CheckForPrevCookie        (path_from_header, host_from_header, name_from_header);    if(prev_cookie) {        prev_cookie->expires = expires;        PR_FREEIF(prev_cookie->cookie);        PR_FREEIF(prev_cookie->path);        PR_FREEIF(prev_cookie->host);        PR_FREEIF(prev_cookie->name);        prev_cookie->cookie = cookie_from_header;        prev_cookie->path = path_from_header;        prev_cookie->host = host_from_header;        prev_cookie->name = name_from_header;        HG83263        prev_cookie->is_domain = is_domain;		prev_cookie->last_accessed = time(NULL);      }	else {		XP_List * list_ptr = net_cookie_list;		net_CookieStruct * tmp_cookie_ptr;		size_t new_len;        /* construct a new cookie_struct         */        prev_cookie = PR_NEW(net_CookieStruct);        if(!prev_cookie) {			PR_FREEIF(path_from_header);			PR_FREEIF(host_from_header);			PR_FREEIF(name_from_header);			PR_FREEIF(cookie_from_header);			net_unlock_cookie_list();#if defined(CookieManagement)			net_IntSetCookieStringInUse = FALSE;			net_UndeferCookies();#endif			return;          }            /* copy         */        prev_cookie->cookie  = cookie_from_header;        prev_cookie->name    = name_from_header;        prev_cookie->path    = path_from_header;        prev_cookie->host    = host_from_header;        prev_cookie->expires = expires;        HG22730        prev_cookie->is_domain = is_domain;		prev_cookie->last_accessed = time(NULL);		if(!net_cookie_list) {			net_cookie_list = XP_ListNew();		    if(!net_cookie_list) {				PR_FREEIF(path_from_header);				PR_FREEIF(name_from_header);				PR_FREEIF(host_from_header);				PR_FREEIF(cookie_from_header);				PR_Free(prev_cookie);				net_unlock_cookie_list();#if defined(CookieManagement)				net_IntSetCookieStringInUse = FALSE;				net_UndeferCookies();#endif				return;			  }		  }				/* add it to the list so that it is before any strings of		 * smaller length		 */		bCookieAdded = FALSE;		new_len = PL_strlen(prev_cookie->path);		while((tmp_cookie_ptr = (net_CookieStruct *) XP_ListNextObject(list_ptr))!=0) { 			if(new_len > PL_strlen(tmp_cookie_ptr->path)) {				XP_ListInsertObject(net_cookie_list, tmp_cookie_ptr, prev_cookie);				bCookieAdded = TRUE;				break;			  }		  }		if ( !bCookieAdded ) {			/* no shorter strings found in list */			XP_ListAddObjectToEnd(net_cookie_list, prev_cookie);		}	  }	/* At this point we know a cookie has changed. Write the cookies to file. */	cookies_changed = TRUE;	NET_SaveCookies(NULL);	net_unlock_cookie_list();#ifdef TRUST_LABELS    {        TrustLabel *trustlabel;        /*         * At this point the cookie was added to         * the cookie list.  So see if there is a trust label that         * matches the cookie and if so add the trust label to the         * cookie permission list.  Existing trust label entries in 		 * the permission list replaced with this latest entry.         */            if ( MatchCookieToLabel2(                    cur_url, prev_cookie->name,                    prev_cookie->path, prev_cookie->host, &trustlabel ) ) {                /*                 * found a match - add the trust info to the proper                 * entry in the cookie permission list                 */                AddTrustLabelInfo( prev_cookie->name, trustlabel );                /* update the disk file */                cookie_permissions_changed = TRUE;                net_SaveCookiePermissions(NULL);            }        }#endif#if defined(CookieManagement)	net_IntSetCookieStringInUse = FALSE;	net_UndeferCookies();#endif	return;}