When parsing a cookie string the ',' character is special because it is used in the date and to differentiate between multiple cookies. When there are multiple set-cookie headers rather then combining them with ', ' use '\n' like Firefox because we are 100% sure that we have multiple cookies and using , can result in cases where the , is interpreted as as part of the date such as the following

set-cookie:a=b; expires=2009 mar 10
set-cookie:c=d

Combined the old way they result in the second cookie being ignored

a=b; expires=2009 mar 10, c=d

Using '\n' moves our cookie parser closer to Firefox's algorithm which
will result in more behavior and bug for bug compatibility.
Attempting to be smarter about the , will result in incompatibility
with Firefox's implementation (as my first attempt at fixing this bug
resulted).

Also when parsing multiple cookies when we have an error
don't return an empty list of cookies, but return the list of
cookies we were able to parse successfully so far.

Signed-off-by: Thiago Macieira <thiago.macieira@nokia.com>
Signed-off-by: Peter Hartmann <peter.hartmann@trolltech.com>

2 files changed, 15 insertions, 3 deletions

diff --git a/src/network/access/qnetworkaccesshttpbackend.cpp b/src/network/access/qnetworkaccesshttpbackend.cpp
index 401dc71..a52b5a0 100644
--- a/src/network/access/qnetworkaccesshttpbackend.cpp
+++ b/src/network/access/qnetworkaccesshttpbackend.cpp
@@ -769,8 +769,12 @@ void QNetworkAccessHttpBackend::replyHeaderChanged()
 
     for (; it != end; ++it) {
         QByteArray value = rawHeader(it->first);
-        if (!value.isEmpty())
-            value += ", ";
+        if (!value.isEmpty()) {
+            if (it->first.toLower() == "set-cookie")
+                value += "\n";
+            else
+                value += ", ";
+        }
         value += it->second;
         setRawHeader(it->first, value);
     }
diff --git a/src/network/access/qnetworkcookie.cpp b/src/network/access/qnetworkcookie.cpp
index 1235960..5c28ff3 100644
--- a/src/network/access/qnetworkcookie.cpp
+++ b/src/network/access/qnetworkcookie.cpp
@@ -543,11 +543,17 @@ QList<QNetworkCookie> QNetworkCookie::parseCookies(const QByteArray &cookieStrin
     while (position < length) {
         QNetworkCookie cookie;
 
+        // When there are multiple SetCookie headers they are join with a new line
+        // \n will always be the start of a new cookie
+        int endOfSetCookie = cookieString.indexOf('\n');
+        if (endOfSetCookie == -1)
+            endOfSetCookie = length;
+
         // The first part is always the "NAME=VALUE" part
         QPair<QByteArray,QByteArray> field = nextField(cookieString, position);
         if (field.first.isEmpty() || field.second.isNull())
             // parsing error
-            return QList<QNetworkCookie>();
+            break;
         cookie.setName(field.first);
         cookie.setValue(field.second);
 
@@ -664,6 +670,8 @@ QList<QNetworkCookie> QNetworkCookie::parseCookies(const QByteArray &cookieStrin
                 }
 
                 position = nextNonWhitespace(cookieString, position);
+                if (position > endOfSetCookie)
+                    endOfCookie = true;
             }
 
         result += cookie;