Allow paths constructed from URLs rather as well as cookie attributes.

net/cookies/canonical_cookie_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cookies/canonical_cookie.h"
 
 #include <memory>
 
 #include "base/memory/ptr_util.h"
 #include "base/test/histogram_tester.h"
@@ skipping 26 matching lines @@
       COOKIE_PRIORITY_DEFAULT));
   EXPECT_EQ("A", cookie2->Name());
   EXPECT_EQ("2", cookie2->Value());
   EXPECT_EQ(".www.example.com", cookie2->Domain());
   EXPECT_EQ("/", cookie2->Path());
   EXPECT_FALSE(cookie2->IsSecure());
   EXPECT_FALSE(cookie2->IsHttpOnly());
   EXPECT_EQ(CookieSameSite::NO_RESTRICTION, cookie2->SameSite());
 }
 
-TEST(CanonicalCookie, SpaceInName) {
-  GURL url("http://www.example.com/test/foo.html");
+TEST(CanonicalCookie, CreationCornerCases) {
   base::Time creation_time = base::Time::Now();
   CookieOptions options;
-  std::unique_ptr<CanonicalCookie> cookie(
-      CanonicalCookie::Create(url, "A C=2", creation_time, options));
+  std::unique_ptr<CanonicalCookie> cookie;
+
+  // Space in name.
+  cookie = CanonicalCookie::Create(GURL("http://www.example.com/test/foo.html"),
+                                   "A C=2", creation_time, options);
   EXPECT_TRUE(cookie.get());
   EXPECT_EQ("A C", cookie->Name());
+
+  // Semicolon in path.
+  cookie = CanonicalCookie::Create(GURL("http://fool/;/"), "*", creation_time,
+                                   options);
+  EXPECT_TRUE(cookie.get());
+
+  // Space in path.
+  cookie = CanonicalCookie::Create(GURL("http://fool/xyzzy wwwww/"), "A=B",

[mmenke, 2017/06/28 00:26:20]

Doesn't GURL precent-escape spaces in paths?

[Randy Smith (Not in Mondays), 2017/06/28 14:58:05]

Yeah, it does :-J.  Ok.  What I think that means in terms of restrictions:
* A cookie attribute value can create a value with a space (not that this makes
sense for the reason you mention, but it could be done), but not a space at the
beginning or end.
* A path created from a URL will not have a space in it period.

So I think the canonical test should be "no space at beginning or end, but
spaces in middle allowed" with positive and negative tests as appropriate in
CreationCornerCases and IsCanonical.  SGTY?

[mmenke, 2017/06/28 17:13:48]

I'm wondering if it's worth the effort - I don't think there's a security issue
with paths that can never actually be matched?  There may also be weird
restrictions (Other characters that can't be in values, and are percent-escaped
in URLs).

[Randy Smith (Not in Mondays), 2017/06/28 17:41:21]

Sure.  My goal at the moment is just to get the fuzzer to shut up.  So combining
your response and that goal: I'll just remove the check against cookie value
parsing for path from the IsCanonical check?

+                                   creation_time, options);
+  EXPECT_TRUE(cookie.get());
 }
 
 TEST(CanonicalCookieTest, Create) {
   // Test creating cookies from a cookie string.
   GURL url("http://www.example.com/test/foo.html");
   base::Time creation_time = base::Time::Now();
   CookieOptions options;
 
   std::unique_ptr<CanonicalCookie> cookie(
       CanonicalCookie::Create(url, "A=2", creation_time, options));
@@ skipping 670 matching lines @@
                                COOKIE_PRIORITY_LOW)
                    .IsCanonical());
 
   // Empty path.
   EXPECT_FALSE(CanonicalCookie("A", "B", "x.y", "", base::Time(), base::Time(),
                                base::Time(), false, false,
                                CookieSameSite::NO_RESTRICTION,
                                COOKIE_PRIORITY_LOW)
                    .IsCanonical());
 
-  // Path suffixed with a space.
-  EXPECT_FALSE(CanonicalCookie("A", "B", "x.y", "/path ", base::Time(),
-                               base::Time(), base::Time(), false, false,
-                               CookieSameSite::NO_RESTRICTION,
-                               COOKIE_PRIORITY_LOW)
-                   .IsCanonical());
-
-  // Path suffixed with separator.
-  EXPECT_FALSE(CanonicalCookie("A", "B", "x.y", "/path;", base::Time(),
-                               base::Time(), base::Time(), false, false,
-                               CookieSameSite::NO_RESTRICTION,
-                               COOKIE_PRIORITY_LOW)
-                   .IsCanonical());
-
   // Simple IPv4 address as domain.
   EXPECT_TRUE(CanonicalCookie("A", "B", "1.2.3.4", "/path", base::Time(),
                               base::Time(), base::Time(), false, false,
                               CookieSameSite::NO_RESTRICTION,
                               COOKIE_PRIORITY_LOW)
                   .IsCanonical());
 
   // NOn-canonical IPv4 address as domain.
   EXPECT_FALSE(CanonicalCookie("A", "B", "01.2.03.4", "/path", base::Time(),
                                base::Time(), base::Time(), false, false,
@@ skipping 150 matching lines @@
                                CanonicalCookie::COOKIE_PREFIX_SECURE, 1);
   EXPECT_TRUE(CanonicalCookie::Create(https_url, "__SecureA=B; Path=/; Secure",
                                       creation_time, options));
   histograms.ExpectBucketCount(kCookiePrefixHistogram,
                                CanonicalCookie::COOKIE_PREFIX_SECURE, 2);
   histograms.ExpectBucketCount(kCookiePrefixBlockedHistogram,
                                CanonicalCookie::COOKIE_PREFIX_SECURE, 1);
 }
 
 }  // namespace net