rv = curURL->GetHostPort(cur_host);
rv = curURL->GetHost(cur_host);
cookie_SetCookieString(nsIURI * curURL, nsIPrompt *aPrompter, const char * setCookieHeader,                       time_t timeToExpire, nsIHttpChannel* aHttpChannel, nsCookieStatus status) {  cookie_CookieStruct * prev_cookie;  char *path_from_header=nsnull, *host_from_header=nsnull;  char *name_from_header=nsnull, *cookie_from_header=nsnull;  nsCAutoString cur_host, cur_path;  nsresult rv;  rv = curURL->GetHostPort(cur_host);  if (NS_FAILED(rv)) {    return;  }  /* Don't let ftp sites set cookies (could be a security issue) */  PRBool isFtp;  if (NS_FAILED(curURL->SchemeIs("ftp", &isFtp)) || isFtp)      return;  rv = curURL->GetPath(cur_path);  if (NS_FAILED(rv)) {    return;  }  char *semi_colon, *ptr, *equal;  PRBool isSecure=PR_FALSE, isDomain=PR_FALSE;  PRBool bCookieAdded;  PRBool pref_scd = PR_FALSE;  /* Only allow cookies to be set in the listed contexts.   * We don't want cookies being set in html mail.    *//* We need to come back and work on this - Neeti   type = context->type;  if(!((type==MWContextBrowser) || (type==MWContextHTMLHelp) || (type==MWContextPane))) {    PR_Free(cur_path);    PR_Free(cur_host);    return;  }*/  if(cookie_GetBehaviorPref() == PERMISSION_DontUse) {    return;  }//printf("\nSetCookieString(URL '%s', header '%s') time %d == %s\n",curURL,setCookieHeader,timeToExpire,asctime(gmtime(&timeToExpire)));  if(cookie_GetLifetimePref() == COOKIE_Discard) {    if(cookie_GetLifetimeTime() < timeToExpire) {      return;    }  }//HG87358 -- @@??  /* terminate at any carriage return or linefeed */  char *setCookieHeaderInternal = nsCRT::strdup(setCookieHeader);  for(ptr=setCookieHeaderInternal; *ptr; ptr++) {    if(*ptr == nsCRT::LF || *ptr == nsCRT::CR) {      *ptr = '\0';      break;    }  }  /* parse path and expires attributes from header if present */  semi_colon = PL_strchr(setCookieHeaderInternal, ';');  if(semi_colon) {    /* truncate at semi-colon and advance */    *semi_colon++ = '\0';    /* there must be some attributes. (hopefully) */    char * localString = nsCRT::strdup(semi_colon); // needed because strtok modifies it arg    char * ptr;    char * token = nsCRT::strtok(localString, " ;", &ptr);    while (token) {      if (PL_strcasecmp(token, "secure") == 0) {        isSecure = PR_TRUE;        break;      }      token = nsCRT::strtok(ptr, " ;", &ptr);    }    nsCRT::free(localString);    /* look for the path attribute */    ptr = PL_strcasestr(semi_colon, "path=");    if(ptr) {      nsCAutoString path(ptr+5);      path.Trim(kWhitespace);      CKutil_StrAllocCopy(path_from_header, path.get());      /* terminate at first space or semi-colon */      for(ptr=path_from_header; *ptr != '\0'; ptr++) {        if(nsString::IsSpace(*ptr) || *ptr == ';' || *ptr == ',') {          *ptr = '\0';          break;        }      }    }    /* look for the URI or URL attribute     *     * This might be a security hole so I'm removing     * it for now.     */    /* look for a domain */    ptr = PL_strcasestr(semi_colon, "domain=");    if(ptr) {      ptr += 7; // get past the "domain="      char *domain_from_header=nsnull;      char *dot, *colon;      int domain_length, cur_host_length;      /* remove leading spaces, else the dot-forcing below will put a dot before the space */      while (nsString::IsSpace(*ptr)) {        ptr++;      }      /* allocate more than we need */      nsCAutoString domain;      if (*ptr != '.' && !cookie_IsIPAddress(cur_host.get())) {        // if host is not an IP address, force domain name to start with a dot        domain = '.';      }      domain.Append(ptr);      domain.Trim(kWhitespace);      CKutil_StrAllocCopy(domain_from_header, domain.get());      /* terminate at first space or semi-colon */      for(ptr=domain_from_header; *ptr != '\0'; ptr++) {        if(nsString::IsSpace(*ptr) || *ptr == ';' || *ptr == ',') {          *ptr = '\0';          break;        }      }      /* verify that this host has the authority to set for this domain.   We do       * this by making sure that the host is in the domain.  We also require       * that a domain have at least two periods to prevent domains of the form       * ".com" and ".edu"       *       * Also make sure that there is more stuff after       * the second dot to prevent ".com."       */      dot = PL_strchr(domain_from_header, '.');      if(dot) {        dot = PL_strchr(dot+1, '.');      }      if(!dot || *(dot+1) == '\0') {        /* did not pass two dot test. FAIL */        PR_FREEIF(path_from_header);        PR_Free(domain_from_header);        // TRACEMSG(("DOMAIN failed two dot test"));        nsCRT::free(setCookieHeaderInternal);        return;      }      /* strip port numbers from the current host for the domain test */      colon = (char *)strchr(cur_host.get(), ':');      if(colon) {        *colon = '\0';      }      domain_length   = PL_strlen(domain_from_header);      cur_host_length = PL_strlen(cur_host.get());      /* check to see if the host is in the domain */      if (!cookie_IsInDomain(domain_from_header, (char*)cur_host.get(), cur_host_length)) {          // TRACEMSG(("DOMAIN failed host within domain test."//        " Domain: %s, Host: %s", domain_from_header, cur_host));        PR_FREEIF(path_from_header);        PR_Free(domain_from_header);        nsCRT::free(setCookieHeaderInternal);        return;      }      /*       * check that portion of host not in domain does not contain a dot       *    This satisfies the fourth requirement in section 4.3.2 of the cookie       *    spec rfc 2109 (see www.cis.ohio-state.edu/htbin/rfc/rfc2109.html).       *    It prevents host of the form x.y.co.nz from setting cookies in the       *    entire .co.nz domain.  Note that this doesn't really solve the problem,       *    it justs makes it more unlikely.  Sites such as y.co.nz can still set       *    cookies for the entire .co.nz domain.       */      /*       *  Although this is the right thing to do(tm), it breaks too many sites.         *  So only do it if the restrictCookieDomains pref is PR_TRUE.       *       */      nsresult rv;      nsCOMPtr<nsIPref> prefs(do_GetService(NS_PREF_CONTRACTID, &rv));      if (!prefs || NS_FAILED(prefs->GetBoolPref(cookie_strictDomainsPref, &pref_scd))) {        pref_scd = PR_FALSE;      }      if ( pref_scd == PR_TRUE ) {        cur_host.SetCharAt(cur_host_length-domain_length, '\0');        dot = (char *)strchr(cur_host.get(), '.');        cur_host.SetCharAt(cur_host_length-domain_length, '.');        if (dot) {        // TRACEMSG(("host minus domain failed no-dot test."        //  " Domain: %s, Host: %s", domain_from_header, cur_host));          PR_FREEIF(path_from_header);          PR_Free(domain_from_header);          nsCRT::free(setCookieHeaderInternal);          return;        }      }      /* all tests passed, copy in domain to hostname field */      CKutil_StrAllocCopy(host_from_header, domain_from_header);      isDomain = PR_TRUE;      // TRACEMSG(("Accepted domain: %s", host_from_header));      PR_Free(domain_from_header);    }  }  /* set path if none found in header, else verify that host has authority for indicated path */  if(!path_from_header) {    /* Strip down everything after the last slash to get the path,     * ignoring slashes in the query string part.     */    char * iter = PL_strchr(cur_path.get(), '?');    if(iter) {      *iter = '\0';    }    iter = PL_strrchr(cur_path.get(), '/');    if(iter) {      *(iter+1) = '\0';    }    path_from_header = nsCRT::strdup(cur_path.get());  } else {    if(PL_strncmp(cur_path.get(), path_from_header, PL_strlen(path_from_header))) {      PR_FREEIF(path_from_header);      PR_FREEIF(host_from_header);      nsCRT::free(setCookieHeaderInternal);      return;    }  }  if(!host_from_header) {    host_from_header = nsCRT::strdup(cur_host.get());  }  /* keep cookies under the max bytes limit */  if(PL_strlen(setCookieHeaderInternal) > MAX_BYTES_PER_COOKIE) {    setCookieHeaderInternal[MAX_BYTES_PER_COOKIE-1] = '\0';  }  /* separate the name from the cookie */  equal = PL_strchr(setCookieHeaderInternal, '=');  if (equal)      *equal = '\0';  nsCAutoString cookieHeader(setCookieHeaderInternal);  cookieHeader.Trim(kWhitespace);  if(equal) {    CKutil_StrAllocCopy(name_from_header, cookieHeader.get());    nsCAutoString value(equal+1);    value.Trim(kWhitespace);    CKutil_StrAllocCopy(cookie_from_header, value.get());  } else {    CKutil_StrAllocCopy(cookie_from_header, cookieHeader.get());    CKutil_StrAllocCopy(name_from_header, "");  }  /* generate the message for the nag box */  int count = cookie_Count(host_from_header);  prev_cookie = cookie_CheckForPrevCookie    (path_from_header, host_from_header, name_from_header);  const char *message_string;  if (prev_cookie) {    message_string = "PermissionToModifyCookie";  } else if (count>1) {    message_string = "PermissionToSetAnotherCookie";  } else if (count==1){    message_string = "PermissionToSetSecondCookie";  } else {    message_string = "PermissionToSetACookie";  }  //TRACEMSG(("mkaccess.c: Setting cookie: %s for host: %s for path: %s",  //          cookie_from_header, host_from_header, path_from_header));  /* construct a new (temporary) cookie_struct, for the nag box */  cookie_CookieStruct * this_cookie;  this_cookie = PR_NEW(cookie_CookieStruct);  if (!this_cookie) {    PR_FREEIF(path_from_header);    PR_FREEIF(host_from_header);    PR_FREEIF(name_from_header);    PR_FREEIF(cookie_from_header);    nsCRT::free(setCookieHeaderInternal);    return;  }  // put the cookie information into the temporary struct.  // just copy pointers to the char * strings (cookie_from_header etc).  // we still own the strings, and we must free them if the cookie is  // rejected.  this_cookie->cookie = cookie_from_header;  this_cookie->name = name_from_header;  this_cookie->path = path_from_header;  this_cookie->host = host_from_header;  this_cookie->expires = cookie_TrimLifetime(timeToExpire);  this_cookie->isSecure = isSecure;  this_cookie->isDomain = isDomain;  this_cookie->lastAccessed = get_current_time();  this_cookie->status = status;  this_cookie->policy = cookie_GetPolicy(P3P_SitePolicy(curURL, aHttpChannel));  /* use common code to determine if we can set the cookie */  PRBool permission = PR_TRUE;  if (NS_SUCCEEDED(PERMISSION_Read())) {    permission = Permission_Check(aPrompter, host_from_header, COOKIEPERMISSION,// I believe this is the right place to eventually add the logic to ask// about cookies that have excessive lifetimes, but it shouldn't be done// until generalized per-site preferences are available.                                       //cookie_GetLifetimeAsk(timeToExpire) ||                                       cookie_GetWarningPref(),                                       this_cookie,                                       message_string, count);  }  if (!permission) {    PR_FREEIF(path_from_header);    PR_FREEIF(host_from_header);    PR_FREEIF(name_from_header);    PR_FREEIF(cookie_from_header);    nsCRT::free(setCookieHeaderInternal);    return;  }  /* limit the number of cookies from a specific host or domain */  cookie_CheckForMaxCookiesFromHost(host_from_header);  if (cookie_list) {    if(cookie_list->Count() > MAX_NUMBER_OF_COOKIES-1) {      cookie_RemoveOldestCookie();    }  }  prev_cookie = cookie_CheckForPrevCookie (path_from_header, host_from_header, name_from_header);  if(prev_cookie) {    prev_cookie->expires = cookie_TrimLifetime(timeToExpire);    PR_FREEIF(prev_cookie->cookie);    PR_FREEIF(prev_cookie->path);    PR_FREEIF(prev_cookie->host);    PR_FREEIF(prev_cookie->name);    prev_cookie->cookie = cookie_from_header;    prev_cookie->path = path_from_header;    prev_cookie->host = host_from_header;    prev_cookie->name = name_from_header;    prev_cookie->isSecure = isSecure;    prev_cookie->isDomain = isDomain;    prev_cookie->lastAccessed = get_current_time();    prev_cookie->status = status;    prev_cookie->policy = cookie_GetPolicy(P3P_SitePolicy(curURL, aHttpChannel));  } else {    cookie_CookieStruct * tmp_cookie_ptr;    size_t new_len;    /* construct a new cookie_struct */    prev_cookie = PR_NEW(cookie_CookieStruct);    if(!prev_cookie) {      PR_FREEIF(path_from_header);      PR_FREEIF(host_from_header);      PR_FREEIF(name_from_header);      PR_FREEIF(cookie_from_header);      nsCRT::free(setCookieHeaderInternal);      return;    }        /* copy */    prev_cookie->cookie = cookie_from_header;    prev_cookie->name = name_from_header;    prev_cookie->path = path_from_header;    prev_cookie->host = host_from_header;    prev_cookie->expires = cookie_TrimLifetime(timeToExpire);    prev_cookie->isSecure = isSecure;    prev_cookie->isDomain = isDomain;    prev_cookie->lastAccessed = get_current_time();    prev_cookie->status = status;    prev_cookie->policy = cookie_GetPolicy(P3P_SitePolicy(curURL, aHttpChannel));    if(!cookie_list) {      cookie_list = new nsVoidArray();      if(!cookie_list) {        PR_FREEIF(path_from_header);        PR_FREEIF(name_from_header);        PR_FREEIF(host_from_header);        PR_FREEIF(cookie_from_header);        PR_Free(prev_cookie);        nsCRT::free(setCookieHeaderInternal);        return;      }    }    /* add it to the list so that it is before any strings of smaller length */    bCookieAdded = PR_FALSE;    new_len = PL_strlen(prev_cookie->path);    for (PRInt32 i = cookie_list->Count(); i > 0;) {      i--;      tmp_cookie_ptr = NS_STATIC_CAST(cookie_CookieStruct*, cookie_list->ElementAt(i));      NS_ASSERTION(tmp_cookie_ptr, "corrupt cookie list");      if(new_len <= PL_strlen(tmp_cookie_ptr->path)) {        cookie_list->InsertElementAt(prev_cookie, i+1);        bCookieAdded = PR_TRUE;        break;      }    }    if ( !bCookieAdded ) {      /* no shorter strings found in list */      cookie_list->InsertElementAt(prev_cookie, 0);    }  }  /* At this point we know a cookie has changed. Make a note to write the cookies to file. */  cookie_changed = PR_TRUE;  nsCRT::free(setCookieHeaderInternal);  /* Notify statusbar if we need to turn on the cookie icon */  if (prev_cookie->status == nsICookie::STATUS_DOWNGRADED ||      prev_cookie->status == nsICookie::STATUS_FLAGGED) {    nsCOMPtr<nsIObserverService> os(do_GetService("@mozilla.org/observer-service;1"));    if (os) {        rv = os->NotifyObservers(nsnull, "cookieIcon", NS_LITERAL_STRING("on").get());    }  }  return;}