From a39eebeb7486ae8d6463c081eb42e5c8123c125e Mon Sep 17 00:00:00 2001
From: Timothy Flynn <trflynn89@pm.me>
Date: Fri, 20 Oct 2023 10:45:30 -0400
Subject: [PATCH] LibWebView: Reject cookies whose domain is on the Public
 Suffix List

---
 Base/res/html/misc/cookie.html              |  2 ++
 Userland/Libraries/LibWebView/CookieJar.cpp | 14 +++++++++++++-
 2 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/Base/res/html/misc/cookie.html b/Base/res/html/misc/cookie.html
index 70cbf8b96a..3ab6fb7721 100644
--- a/Base/res/html/misc/cookie.html
+++ b/Base/res/html/misc/cookie.html
@@ -20,6 +20,8 @@
     <label for=invalid4>The cookie expired in the past</label>
     <br /><input id=invalid5 type=button onclick="setTooLargeCookie()" value="cookie10=[more than 4096 chars]" />
     <label for=invalid5>The cookie is too large</label>
+    <br /><input id=invalid6 type=button onclick="setCookie(this.value)" value="cookie11=value11; domain=uk.gov" />
+    <label for=invalid6>The cookie's domain is on the Public Suffix List</label>
     <br />
 
     <h3>Unretrievable cookies (the browser should accept these but not display them):</h3>
diff --git a/Userland/Libraries/LibWebView/CookieJar.cpp b/Userland/Libraries/LibWebView/CookieJar.cpp
index bec1e5b8ca..5e40d1ee31 100644
--- a/Userland/Libraries/LibWebView/CookieJar.cpp
+++ b/Userland/Libraries/LibWebView/CookieJar.cpp
@@ -19,6 +19,7 @@
 #include <LibWeb/Cookie/ParsedCookie.h>
 #include <LibWebView/CookieJar.h>
 #include <LibWebView/Database.h>
+#include <LibWebView/URL.h>
 
 namespace WebView {
 
@@ -316,7 +317,18 @@ void CookieJar::store_cookie(Web::Cookie::ParsedCookie const& parsed_cookie, con
     }
 
     // 5. If the user agent is configured to reject "public suffixes" and the domain-attribute is a public suffix:
-    // FIXME: Support rejection of public suffixes. The full list is here: https://publicsuffix.org/list/public_suffix_list.dat
+    if (is_public_suffix(cookie.domain)) {
+        // If the domain-attribute is identical to the canonicalized request-host:
+        if (cookie.domain == canonicalized_domain) {
+            // Let the domain-attribute be the empty string.
+            cookie.domain = DeprecatedString::empty();
+        }
+        // Otherwise:
+        else {
+            // Ignore the cookie entirely and abort these steps.
+            return;
+        }
+    }
 
     // 6. If the domain-attribute is non-empty:
     if (!cookie.domain.is_empty()) {