Fix removal of cookies without a Domain field
ClosedPublic

Authored by stefanocrocco on Jul 10 2019, 8:45 AM.

Details

Summary

Cookies without a Domain field weren't removed from KCookieServer because
WebEnginePartCookieJar::removeCookie called KCookieServer::deleteCookie passing
the whole URL as second argument instead of only passing the host. This had no
effect on cookies with a Domain field, but prevented KCookieServer to delete it
in case the cookie had no domain field.

This bug had visible consequences, for example when logging in GMail. With the
previous behavior, the following steps lead to a "Cookie Mismatch" message from
GMail:

  • log into GMail
  • log out from GMail
  • quit Konqueror
  • restart Konqueror
  • attempt to log into GMail

With this fix, the second attempt to log into GMail succeeds.

Test Plan

Run autotests. Try the steps described above if you have a GMail
account

Diff Detail

Repository
R226 Konqueror
Lint
Automatic diff as part of commit; lint not applicable.
Unit
Automatic diff as part of commit; unit tests not applicable.
stefanocrocco requested review of this revision.Jul 10 2019, 8:45 AM
stefanocrocco created this revision.
dfaure added inline comments.Jul 12 2019, 7:51 AM
webenginepart/autotests/webenginepartcookiejar_test.cpp
243

the comma here was correct (as per C++11) and allows adding more lines without touching this one (smaller diffs, less risks of conflicts)

280

Are all callers of findCookies() going to remember to do path.isEmpty() ? "/" : path?
Wouldn't it be more robust to do this in findCookies itself?

Or to say this another way -- if other callers of findCookies don't do this, and if we don't want to change them (nor kcookieserver), then this adjustment is wrong. possibly?

stefanocrocco added inline comments.Jul 12 2019, 8:20 AM
webenginepart/autotests/webenginepartcookiejar_test.cpp
280

I don't think so. If I read the cookie specification correctly, an empty path or a path consisting of a single / should be equivalent. However, while KCookieServer::findCookies actually returns an empty string when the path is empty, QNetworkCookie::normalize converts an empty path to a /.

Sorry for digging, just trying to help catch more bugs :)

webenginepart/autotests/webenginepartcookiejar_test.cpp
280

Ah, so it's a Q-K conversion thing, then it's normal that the other users of KCookieServer don't do this. OK.

But then why is it only done in the unittest and not in the actual code?

I'm also confused because you say "findCookies returns..." but this here is about the argument *passed* to findCookies.

webenginepart/src/webenginepartcookiejar.cpp
236

Can id.path be empty?

stefanocrocco added inline comments.Jul 13 2019, 11:48 AM
webenginepart/autotests/webenginepartcookiejar_test.cpp
280

Because of the call to QNetworkCookie::normalize while setting up the test data (line 254), the cookie's path is never empty. So, the cookie added to KCookieServer can have either a real path or a path which is simply /. This is the reason of the conditional here. However, reading the code again I think it's not the best way to do it. I'll rewrite it to make it better and clearer.

webenginepart/src/webenginepartcookiejar.cpp
236

In theory, it can. In practice, it shouldn't. The cookies received by QWebEngineCookieStore don't ever have an empty path. The only way to have an empty path is if some other application adds a cookie to KCookieServer and that cookie is then added to QWebEngineCookieStore from KCookieServer when Konqueror starts.

  • Test both if path is empty and if path is /
dfaure accepted this revision.Jul 13 2019, 9:45 PM
This revision is now accepted and ready to land.Jul 13 2019, 9:45 PM
This revision was automatically updated to reflect the committed changes.