http/cookie: Don't allow a partial domain-match against an IP

Author: daurnimator

http/cookie.lua

@@ -98,7 +98,7 @@ local function domain_match(domain_string, str)
 	return str == domain_string or (
 		str:sub(-#domain_string) == domain_string
 		and str:sub(-#domain_string-1, -#domain_string-1) == "."
-		-- TODO: check if IP address?
+		and not http_util.is_ip(str)
 	)
 end
 

spec/cookie_spec.lua

@@ -78,6 +78,10 @@ describe("cookie module", function()
 			local s = http_cookie.new_store()
 			assert.falsy(s:store("example.com", "/", true, true, nil, http_cookie.parse_setcookie("foo=bar; Domain=subdomain.example.com")))
 		end)
+		it("doesn't domain-match a partial ip", function()
+			local s = http_cookie.new_store()
+			assert.falsy(s:store("127.0.0.1", "/", true, true, nil, http_cookie.parse_setcookie("foo=bar; Domain=0.0.1")))
+		end)
 	end)
 	describe("domain-match on lookup", function()
 		it("matches domains correctly when host_only flag is true", function()