Remove dangerous CanonicalCookie::Create method.

net/cookies/cookie_monster.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Portions of this code based on Mozilla:
 //   (netwerk/cookie/src/nsCookieService.cpp)
 /* ***** BEGIN LICENSE BLOCK *****
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
  *
  * The contents of this file are subject to the Mozilla Public License Version
@@ skipping 1040 matching lines @@
   // TODO(mmenke): This class assumes each cookie to have a unique creation
   // time. Allowing the caller to set the creation time violates that
   // assumption. Worth fixing? Worth noting that time changes between browser
   // restarts can cause the same issue.
   base::Time actual_creation_time = creation_time;
   if (creation_time.is_null()) {
     actual_creation_time = CurrentTime();
     last_time_seen_ = actual_creation_time;
   }
 
+  // Validate consistency of passed arguments.
+  if (ParsedCookie::ParseTokenString(name) != name)
+    return false;
+  if (ParsedCookie::ParseTokenString(value) != value)
+    return false;
+  if (ParsedCookie::ParseTokenString(domain) != domain)
+    return false;
+  if (ParsedCookie::ParseValueString(path) != path)
+    return false;
+
+  // Validate passed arguments against URL.
+  if (secure && !url.SchemeIsCryptographic())
+    return false;
+
+  std::string cookie_domain;
+  if (!cookie_util::GetCookieDomainWithString(url, domain, &cookie_domain))
+    return false;
+
+  std::string cookie_path = CanonicalCookie::CanonPathWithString(url, path);
+  if (!path.empty() && cookie_path != path)
+    return false;
+
+  // Canonicalize path again to make sure it escapes characters as needed.
+  url::Component path_component(0, cookie_path.length());
+  url::RawCanonOutputT<char> canon_path;
+  url::Component canon_path_component;
+  url::CanonicalizePath(cookie_path.data(), path_component, &canon_path,
+                        &canon_path_component);
+  cookie_path = std::string(canon_path.data() + canon_path_component.begin,
+                            canon_path_component.len);
+
   std::unique_ptr<CanonicalCookie> cc(CanonicalCookie::Create(
-      url, name, value, domain, path, actual_creation_time, expiration_time,
-      secure, http_only, same_site, priority));
+      name, value, cookie_domain, path, actual_creation_time, expiration_time,
+      last_access_time, secure, http_only, same_site, priority));
 
   if (!cc.get())
     return false;
 
-  if (!last_access_time.is_null())
-    cc->SetLastAccessDate(last_access_time);
-
   CookieOptions options;
   options.set_include_httponly();
   options.set_same_site_cookie_mode(
       CookieOptions::SameSiteCookieMode::INCLUDE_STRICT_AND_LAX);
   return SetCanonicalCookie(std::move(cc), url, options);
 }
 
 CookieList CookieMonster::GetAllCookies() {
   DCHECK(thread_checker_.CalledOnValidThread());
 
@@ skipping 1287 matching lines @@
        it != hook_map_.end(); ++it) {
     std::pair<GURL, std::string> key = it->first;
     if (cookie.IncludeForRequestURL(key.first, opts) &&
         cookie.Name() == key.second) {
       it->second->Notify(cookie, cause);
     }
   }
 }
 
 }  // namespace net