Replace std::string::find with base::StartsWith when comparing cookie paths.

net/cookies/canonical_cookie.cc

Index: net/cookies/canonical_cookie.cc
diff --git a/net/cookies/canonical_cookie.cc b/net/cookies/canonical_cookie.cc
index fff3fa44b928cf95f2052cef60c7a1f4ca3cc753..0a5e794fe81cdbea370de2ad45c467d900707fbe 100644
--- a/net/cookies/canonical_cookie.cc
+++ b/net/cookies/canonical_cookie.cc
@@ -47,6 +47,7 @@
 #include "base/format_macros.h"
 #include "base/logging.h"
 #include "base/metrics/histogram_macros.h"
+#include "base/strings/string_util.h"
 #include "base/strings/stringprintf.h"
 #include "net/cookies/cookie_util.h"
 #include "net/cookies/parsed_cookie.h"
@@ -349,15 +350,14 @@ bool CanonicalCookie::IsOnPath(const std::string& url_path) const {
   // was longer, the same length, or shorter than the length of the url path.
   // I think the approach below is simpler.
 
-  // Make sure the cookie path is a prefix of the url path.  If the
-  // url path is shorter than the cookie path, then the cookie path
-  // can't be a prefix.
-  if (url_path.find(path_) != 0)
+  // Make sure the cookie path is a prefix of the url path.  If the url path is
+  // shorter than the cookie path, then the cookie path can't be a prefix.
+  if (!base::StartsWith(url_path, path_, base::CompareCase::SENSITIVE))

[mmenke, 2016/03/02 20:02:01]

Does this really mean that you can set cookies with paths "bar" and "bar/"...And
the first would not be returned for "bar", but both would be returned for
"bar/"?

[Mike West, 2016/03/03 18:56:28]

That sounds wrong. The path matching algorithm at
https://tools.ietf.org/html/rfc6265#section-5.1.4 says 'The cookie-path is a
prefix of the request-path, and the first character of the request-path that is
not included in the cookie-path is a %x2F ("/") character.' `path=/bar` should
match `/bar/foo` and `/bar`.

[mmenke, 2016/03/03 19:02:58]

Sorry, that should be "/bar/" and "/bar"...  and was meant to go below line 367.
(Notice the path_.back() check, in particular)

     return false;
 
-  // Now we know that url_path is >= cookie_path, and that cookie_path
-  // is a prefix of url_path.  If they are the are the same length then
-  // they are identical, otherwise we need an additional check:
+  // |url_path| is >= |path_|, and |path_| is a prefix of |url_path|.  If they
+  // are the are the same length then they are identical, otherwise need an
+  // additional check:
 
   // In order to avoid in correctly matching a cookie path of /blah
   // with a request path of '/blahblah/', we need to make sure that either
@@ -365,8 +365,9 @@ bool CanonicalCookie::IsOnPath(const std::string& url_path) const {
   // in the url path.  Since we know that the url path length is greater
   // than the cookie path length, it's safe to index one byte past.
   if (path_.length() != url_path.length() && path_.back() != '/' &&
-      url_path[path_.length()] != '/')
+      url_path[path_.length()] != '/') {
     return false;
+  }
 
   return true;
 }