Remove dangerous CanonicalCookie::Create method.

net/cookies/canonical_cookie.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_COOKIES_CANONICAL_COOKIE_H_
 #define NET_COOKIES_CANONICAL_COOKIE_H_
 
 #include <memory>
 #include <string>
 #include <vector>
@@ skipping 22 matching lines @@
   // Creates a new |CanonicalCookie| from the |cookie_line| and the
   // |creation_time|. Canonicalizes and validates inputs. May return NULL if
   // an attribute value is invalid.
   static std::unique_ptr<CanonicalCookie> Create(
       const GURL& url,
       const std::string& cookie_line,
       const base::Time& creation_time,
       const CookieOptions& options);
 
   // Creates a canonical cookie from unparsed attribute values.
-  // Canonicalizes and validates inputs.  May return NULL if an attribute
-  // value is invalid.
-  static std::unique_ptr<CanonicalCookie> Create(const GURL& url,
-                                                 const std::string& name,
-                                                 const std::string& value,
-                                                 const std::string& domain,
-                                                 const std::string& path,
-                                                 const base::Time& creation,
-                                                 const base::Time& expiration,
-                                                 bool secure,
-                                                 bool http_only,
-                                                 CookieSameSite same_site,
-                                                 CookiePriority priority);
-
-  // Creates a canonical cookie from unparsed attribute values.
-  // It does not do any validation.
+  // It does not do any canonicalization.
+  // |name| and |path| may not be empty.

[mmenke, 2017/05/09 16:51:09]

I think this is a MUST and not a MAY.  :)

[Randy Smith (Not in Mondays), 2017/05/09 23:52:35]

Done :-}.

   static std::unique_ptr<CanonicalCookie> Create(const std::string& name,
                                                  const std::string& value,
                                                  const std::string& domain,
                                                  const std::string& path,
                                                  const base::Time& creation,
                                                  const base::Time& expiration,
                                                  const base::Time& last_access,
                                                  bool secure,
                                                  bool http_only,
                                                  CookieSameSite same_site,
@@ skipping 61 matching lines @@
 
   // Returns true if the cookie should be included for the given request |url|.
   // HTTP only cookies can be filter by using appropriate cookie |options|.
   // PLEASE NOTE that this method does not check whether a cookie is expired or
   // not!
   bool IncludeForRequestURL(const GURL& url,
                             const CookieOptions& options) const;
 
   std::string DebugString() const;
 
-  static std::string CanonPath(const GURL& url, const ParsedCookie& pc);
+  static std::string CanonPathWithString(const GURL& url,
+                                         const std::string& path_string);

[mmenke, 2017/05/09 16:51:09]

Does this need to be public (Or even outside a private namespace in the cc
file?)  I'm not seeing anything that uses it.

[Randy Smith (Not in Mondays), 2017/05/09 23:52:35]

It's used in cookie_monster.cc.  We could look into ways to make it only visible
there and to CC, but I think something like this is going to be needed as per my
recent email to you and mkwst@, so my inclination is not to put a lot of energy
into it.

 
   // Returns a "null" time if expiration was unspecified or invalid.
   static base::Time CanonExpiration(const ParsedCookie& pc,
                                     const base::Time& current,
                                     const base::Time& server_time);
 
   // Cookie ordering methods.
 
   // Returns true if the cookie is less than |other|, considering only name,
   // domain and path. In particular, two equivalent cookies (see IsEquivalent())
@@ skipping 62 matching lines @@
   bool httponly_;
   CookieSameSite same_site_;
   CookiePriority priority_;
 };
 
 typedef std::vector<CanonicalCookie> CookieList;
 
 }  // namespace net
 
 #endif  // NET_COOKIES_CANONICAL_COOKIE_H_