🐛 bug: enforce CookieJar domain acceptance and host-only cookie matching

client/client_test.go

@@ -221,7 +221,7 @@ func TestClientResetClearsState(t *testing.T) {
 	client := New()
 
 	jar := AcquireCookieJar()
-	jar.hostCookies = map[string][]*fasthttp.Cookie{"example.com": {}}
+	jar.hostCookies = map[string][]storedCookie{"example.com": {}}
 	client.SetCookieJar(jar)
 
 	client.SetBaseURL("http://example.com")
@@ -1446,7 +1446,8 @@ func Test_Client_Cookie_With_Server(t *testing.T) {
 
 	handler := func(c fiber.Ctx) error {
 		return c.SendString(
-			c.Cookies("k1") + c.Cookies("k2") + c.Cookies("k3") + c.Cookies("k4"))
+			c.Cookies("k1") + c.Cookies("k2") + c.Cookies("k3") + c.Cookies("k4"),
+		)
 	}
 
 	wrapAgent := func(c *Client) {
@@ -1464,7 +1465,8 @@ func Test_Client_Cookie_With_Server(t *testing.T) {
 func Test_Client_CookieJar(t *testing.T) {
 	handler := func(c fiber.Ctx) error {
 		return c.SendString(
-			c.Cookies("k1") + c.Cookies("k2") + c.Cookies("k3"))
+			c.Cookies("k1") + c.Cookies("k2") + c.Cookies("k3"),
+		)
 	}
 
 	jar := AcquireCookieJar()
@@ -1491,7 +1493,8 @@ func Test_Client_CookieJar_Response(t *testing.T) {
 				Value: "v4",
 			})
 			return c.SendString(
-				c.Cookies("k1") + c.Cookies("k2") + c.Cookies("k3"))
+				c.Cookies("k1") + c.Cookies("k2") + c.Cookies("k3"),
+			)
 		}
 
 		jar := AcquireCookieJar()
@@ -1518,7 +1521,8 @@ func Test_Client_CookieJar_Response(t *testing.T) {
 				Expires: time.Now().Add(1 * time.Nanosecond),
 			})
 			return c.SendString(
-				c.Cookies("k1") + c.Cookies("k2") + c.Cookies("k3"))
+				c.Cookies("k1") + c.Cookies("k2") + c.Cookies("k3"),
+			)
 		}
 
 		jar := AcquireCookieJar()
@@ -1544,7 +1548,8 @@ func Test_Client_CookieJar_Response(t *testing.T) {
 				Value: "v2",
 			})
 			return c.SendString(
-				c.Cookies("k1") + c.Cookies("k2"))
+				c.Cookies("k1") + c.Cookies("k2"),
+			)
 		}
 
 		jar := AcquireCookieJar()

client/cookiejar.go

@@ -38,10 +38,15 @@ func ReleaseCookieJar(c *CookieJar) {
 
 // CookieJar manages cookie storage for the client. It stores cookies keyed by host.
 type CookieJar struct {
-	hostCookies map[string][]*fasthttp.Cookie
+	hostCookies map[string][]storedCookie
 	mu          sync.Mutex
 }
 
+type storedCookie struct {
+	cookie   *fasthttp.Cookie
+	hostOnly bool
+}
+
 // Get returns all cookies stored for a given URI. If there are no cookies for the
 // provided host, the returned slice will be nil.
 //
@@ -81,20 +86,25 @@ func (cj *CookieJar) getCookiesByHost(host string) []*fasthttp.Cookie {
 	defer cj.mu.Unlock()
 
 	now := time.Now()
-	cookies := cj.hostCookies[host]
+	stored := cj.hostCookies[host]
 
-	kept := cookies[:0]
-	for _, c := range cookies {
+	kept := stored[:0]
+	for _, sc := range stored {
+		c := sc.cookie
 		// Remove expired cookies.
 		if !c.Expire().Equal(fasthttp.CookieExpireUnlimited) && c.Expire().Before(now) {
 			fasthttp.ReleaseCookie(c)
 			continue
 		}
-		kept = append(kept, c)
+		kept = append(kept, sc)
 	}
 	cj.hostCookies[host] = kept
 
-	return kept
+	out := make([]*fasthttp.Cookie, 0, len(kept))
+	for _, sc := range kept {
+		out = append(out, sc.cookie)
+	}
+	return out
 }
 
 // cookiesForRequest returns cookies that match the given host, path and security settings.
@@ -108,17 +118,24 @@ func (cj *CookieJar) cookiesForRequest(host string, path []byte, secure bool) []
 	var matched []*fasthttp.Cookie
 
 	for domain, cookies := range cj.hostCookies {
+		if len(cookies) == 0 {
+			continue
+		}
+		if cookies[0].hostOnly && host != domain {
+			continue
+		}
 		if !domainMatch(host, domain) {
 			continue
 		}
 
 		kept := cookies[:0]
-		for _, c := range cookies {
+		for _, sc := range cookies {
+			c := sc.cookie
 			if !c.Expire().Equal(fasthttp.CookieExpireUnlimited) && c.Expire().Before(now) {
 				fasthttp.ReleaseCookie(c)
 				continue
 			}
-			kept = append(kept, c)
+			kept = append(kept, sc)
 
 			if !pathMatch(path, c.Path()) {
 				continue
@@ -163,7 +180,7 @@ func (cj *CookieJar) SetByHost(host []byte, cookies ...*fasthttp.Cookie) {
 	defer cj.mu.Unlock()
 
 	if cj.hostCookies == nil {
-		cj.hostCookies = make(map[string][]*fasthttp.Cookie)
+		cj.hostCookies = make(map[string][]storedCookie)
 	}
 
 	for _, cookie := range cookies {
@@ -180,9 +197,16 @@ func (cj *CookieJar) SetByHost(host []byte, cookies ...*fasthttp.Cookie) {
 		hostCookies := cj.hostCookies[key]
 
 		existing := searchCookieByKeyAndPath(cookie.Key(), cookie.Path(), hostCookies)
+		hostOnly := len(domain) == 0
 		if existing == nil {
 			existing = fasthttp.AcquireCookie()
-			hostCookies = append(hostCookies, existing)
+			hostCookies = append(hostCookies, storedCookie{cookie: existing, hostOnly: hostOnly})
+		} else {
+			for i := range hostCookies {
+				if hostCookies[i].cookie == existing {
+					hostCookies[i].hostOnly = hostOnly
+				}
+			}
 		}
 		existing.CopyTo(cookie)
 		cj.hostCookies[key] = hostCookies
@@ -235,7 +259,7 @@ func (cj *CookieJar) parseCookiesFromResp(host, _ []byte, resp *fasthttp.Respons
 	defer cj.mu.Unlock()
 
 	if cj.hostCookies == nil {
-		cj.hostCookies = make(map[string][]*fasthttp.Cookie)
+		cj.hostCookies = make(map[string][]storedCookie)
 	}
 
 	now := time.Now()
@@ -246,9 +270,15 @@ func (cj *CookieJar) parseCookiesFromResp(host, _ []byte, resp *fasthttp.Respons
 		domainBytes := utils.TrimLeft(tmp.Domain(), '.')
 		utilsbytes.UnsafeToLower(domainBytes)
 		key := hostKey
-		if len(domainBytes) == 0 {
+		hostOnly := len(domainBytes) == 0
+		if hostOnly {
 			tmp.SetDomain(hostStr)
 		} else {
+			domain := utils.UnsafeString(domainBytes)
+			if !domainMatch(hostStr, domain) {
+				fasthttp.ReleaseCookie(tmp)
+				continue
+			}
 			key = utils.CopyString(utils.UnsafeString(domainBytes))
 			tmp.SetDomainBytes(domainBytes)
 		}
@@ -257,7 +287,13 @@ func (cj *CookieJar) parseCookiesFromResp(host, _ []byte, resp *fasthttp.Respons
 		c := searchCookieByKeyAndPath(tmp.Key(), tmp.Path(), cookies)
 		if c == nil {
 			c = fasthttp.AcquireCookie()
-			cookies = append(cookies, c)
+			cookies = append(cookies, storedCookie{cookie: c, hostOnly: hostOnly})
+		} else {
+			for i := range cookies {
+				if cookies[i].cookie == c {
+					cookies[i].hostOnly = hostOnly
+				}
+			}
 		}
 
 		c.CopyTo(tmp)
@@ -266,7 +302,7 @@ func (cj *CookieJar) parseCookiesFromResp(host, _ []byte, resp *fasthttp.Respons
 		} else {
 			kept := cookies[:0]
 			for _, v := range cookies {
-				if v != c {
+				if v.cookie != c {
 					kept = append(kept, v)
 				}
 			}
@@ -291,8 +327,9 @@ func (cj *CookieJar) Release() {
 }
 
 // searchCookieByKeyAndPath looks up a cookie by its key and path from the provided slice of cookies.
-func searchCookieByKeyAndPath(key, path []byte, cookies []*fasthttp.Cookie) *fasthttp.Cookie {
-	for _, c := range cookies {
+func searchCookieByKeyAndPath(key, path []byte, cookies []storedCookie) *fasthttp.Cookie {
+	for _, sc := range cookies {
+		c := sc.cookie
 		if bytes.Equal(key, c.Key()) {
 			if pathMatch(path, c.Path()) {
 				return c

client/cookiejar_test.go

@@ -259,6 +259,43 @@ func Test_CookieJar_Domain(t *testing.T) {
 	require.Equal(t, "v", string(cookies[0].Value()))
 }
 
+func Test_CookieJar_HostOnlyCookieNotSentToSubdomain(t *testing.T) {
+	t.Parallel()
+
+	jar := &CookieJar{}
+	origin := fasthttp.AcquireURI()
+	require.NoError(t, origin.Parse(nil, []byte("http://example.com/")))
+
+	c := &fasthttp.Cookie{}
+	c.SetKey("sid")
+	c.SetValue("123")
+	jar.Set(origin, c)
+
+	subdomain := fasthttp.AcquireURI()
+	require.NoError(t, subdomain.Parse(nil, []byte("http://attacker.example.com/")))
+	require.Empty(t, jar.Get(subdomain))
+}
+
+func Test_CookieJar_RejectUnrelatedResponseDomain(t *testing.T) {
+	t.Parallel()
+
+	jar := &CookieJar{}
+	resp := fasthttp.AcquireResponse()
+	host := []byte("attacker.invalid")
+
+	c := &fasthttp.Cookie{}
+	c.SetKey("sess")
+	c.SetValue("evil")
+	c.SetDomain("victim.example")
+	resp.Header.SetCookie(c)
+
+	jar.parseCookiesFromResp(host, nil, resp)
+
+	uri := fasthttp.AcquireURI()
+	require.NoError(t, uri.Parse(nil, []byte("http://victim.example/")))
+	require.Empty(t, jar.Get(uri))
+}
+
 func Test_CookieJar_Secure(t *testing.T) {
 	t.Parallel()