Add validation to construction of Cookie objects.

sdk/lib/io/http_headers.dart

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 part of dart.io;
 
 class _HttpHeaders implements HttpHeaders {
   final Map<String, List<String>> _headers;
   final String protocolVersion;
 
@@ skipping 477 matching lines @@
         skipWS();
         if (done()) return;
         String name = parseName();
         skipWS();
         if (!expect("=")) {
           index = s.indexOf(';', index);
           continue;
         }
         skipWS();
         String value = parseValue();
-        cookies.add(new _Cookie(name, value));
+        try {
+          cookies.add(new _Cookie(name, value));
+        } catch (_) {
+          // Skip it, invalid cookie data.
+        }
         skipWS();
         if (done()) return;
         if (!expect(";")) {
           index = s.indexOf(';', index);
           continue;
         }
       }
     }
     List<String> values = _headers[HttpHeaders.COOKIE];
     if (values != null) {
@@ skipping 202 matching lines @@
 class _Cookie implements Cookie {
   String name;
   String value;
   DateTime expires;
   int maxAge;
   String domain;
   String path;
   bool httpOnly = false;
   bool secure = false;
 
-  _Cookie([this.name, this.value]);
+  _Cookie([this.name, this.value]) {
+    _validate();
+  }
 
   _Cookie.fromSetCookieValue(String value) {
     // Parse the 'set-cookie' header value.
     _parseSetCookieValue(value);
   }
 
   // Parse a 'set-cookie' header value according to the rules in RFC 6265.
   void _parseSetCookieValue(String s) {
     int index = 0;
 
@@ skipping 67 matching lines @@
         if (!done()) index++;  // Skip the ; character
       }
     }
 
     name = parseName();
     if (done() || name.length == 0) {
       throw new HttpException("Failed to parse header value [$s]");
     }
     index++;  // Skip the = character.
     value = parseValue();
+    _validate();
     if (done()) return;
     index++;  // Skip the ; character.
     parseAttributes();
   }
 
   String toString() {
     StringBuffer sb = new StringBuffer();
     sb..write(name)..write("=")..write(value);
     if (expires != null) {
       sb..write("; Expires=")..write(HttpDate.format(expires));
     }
     if (maxAge != null) {
       sb..write("; Max-Age=")..write(maxAge);
     }
     if (domain != null) {
       sb..write("; Domain=")..write(domain);
     }
     if (path != null) {
       sb..write("; Path=")..write(path);
     }
     if (secure) sb.write("; Secure");
     if (httpOnly) sb.write("; HttpOnly");
     return sb.toString();
   }
+
+  void _validate() {
+    const SEPERATORS = const [
+        "(", ")", "<", ">", "@", ",", ";", ":", "\\",
+        '"', "/", "[", "]", "?", "=", "{", "}"];
+    for (int i = 0; i < name.length; i++) {
+      int codeUnit = name.codeUnits[i];
+      if (codeUnit <= 32 ||
+          codeUnit >= 127 ||
+          SEPERATORS.indexOf(name[i]) >= 0) {
+        throw new FormatException(
+            "Invalid character in cookie name, code unit: '$codeUnit'");
+      }
+    }
+    for (int i = 0; i < value.length; i++) {
+      int codeUnit = value.codeUnits[i];
+      if (!(codeUnit == 0x21 ||
+            (codeUnit >= 0x23 && codeUnit <= 0x2B) ||
+            (codeUnit >= 0x2D && codeUnit <= 0x3A) ||
+            (codeUnit >= 0x3C && codeUnit <= 0x5B) ||
+            (codeUnit >= 0x5D && codeUnit <= 0x7E))) {
+        throw new FormatException(
+            "Invalid character in cookie value, code unit: '$codeUnit'");
+      }
+    }
+  }
 }
 
 
 class _UnmodifiableMap<K, V> implements Map<K, V> {
   final Map _map;
   const _UnmodifiableMap(this._map);
 
   bool containsValue(Object value) => _map.containsValue(value);
   bool containsKey(Object key) => _map.containsKey(key);
   V operator [](Object key) => _map[key];
@@ skipping 12 matching lines @@
   void clear() {
     throw new UnsupportedError("Cannot modify an unmodifiable map");
   }
   void forEach(void f(K key, V value)) => _map.forEach(f);
   Iterable<K> get keys => _map.keys;
   Iterable<V> get values => _map.values;
   int get length => _map.length;
   bool get isEmpty => _map.isEmpty;
   bool get isNotEmpty => _map.isNotEmpty;
 }