Merge branch '4.5' of git@scm.dev.nokia.troll.no:qt/qt

1 files changed, 11 insertions, 5 deletions

diff --git a/src/network/access/qnetworkcookie.cpp b/src/network/access/qnetworkcookie.cpp
index c8d6097..e921318 100644
--- a/src/network/access/qnetworkcookie.cpp
+++ b/src/network/access/qnetworkcookie.cpp
@@ -1013,14 +1013,14 @@ QList<QNetworkCookie> QNetworkCookie::parseCookies(const QByteArray &cookieStrin
                     cookie.setExpirationDate(dt);
                 } else if (field.first == "domain") {
                     QByteArray rawDomain = field.second;
-                    QString maybeLeadingDot;
                     if (rawDomain.startsWith('.')) {
-                        maybeLeadingDot = QLatin1Char('.');
                         rawDomain = rawDomain.mid(1);
                     }
-
                     QString normalizedDomain = QUrl::fromAce(QUrl::toAce(QString::fromUtf8(rawDomain)));
-                    cookie.setDomain(maybeLeadingDot + normalizedDomain);
+                    // always add the dot, there are some servers that forget the
+                    // leading dot. This is actually forbidden according to RFC 2109,
+                    // but all browsers accept it anyway so we do that as well
+                    cookie.setDomain(QLatin1Char('.') + normalizedDomain);
                 } else if (field.first == "max-age") {
                     bool ok = false;
                     int secs = field.second.toInt(&ok);
@@ -1221,7 +1221,6 @@ bool QNetworkCookieJar::setCookiesFromUrl(const QList<QNetworkCookie> &cookieLis
                           cookie.expirationDate() < now;
 
         // validate the cookie & set the defaults if unset
-        // (RFC 2965: "The request-URI MUST path-match the Path attribute of the cookie.")
         if (cookie.path().isEmpty())
             cookie.setPath(defaultPath);
         else if (!isParentPath(pathAndFileName, cookie.path()))
@@ -1235,6 +1234,13 @@ bool QNetworkCookieJar::setCookiesFromUrl(const QList<QNetworkCookie> &cookieLis
                 || isParentDomain(defaultDomain, domain))) {
                     continue;           // not accepted
             }
+
+            // reject if domain is like ".com"
+            // (i.e., reject if domain does not contain embedded dots, see RFC 2109 section 4.3.2)
+            // this is just a rudimentary check and does not cover all cases
+            if (domain.lastIndexOf(QLatin1Char('.')) == 0)
+                continue;           // not accepted
+
         }
 
         QList<QNetworkCookie>::Iterator it = d->allCookies.begin(),