Fix #397: Allow all cookie names that conform to the RFC

- Lenient flag is not needed anymore

codec-http/src/main/java/io/netty/handler/codec/http/CookieDecoder.java

@@ -49,24 +49,6 @@ public class CookieDecoder {
 
     private static final String COMMA = ",";
 
-    private final boolean lenient;
-
-    /**
-     * Creates a new decoder with strict parsing.
-     */
-    public CookieDecoder() {
-        this(false);
-    }
-
-    /**
-     * Creates a new decoder.
-     *
-     * @param lenient ignores cookies with the name 'HTTPOnly' instead of throwing an exception
-     */
-    public CookieDecoder(boolean lenient) {
-        this.lenient = lenient;
-    }
-
     /**
      * Decodes the specified HTTP header value into {@link Cookie}s.
      *
@@ -105,11 +87,6 @@ public class CookieDecoder {
         Set<Cookie> cookies = new TreeSet<Cookie>();
         for (; i < names.size(); i ++) {
             String name = names.get(i);
-            // Not all user agents understand the HttpOnly attribute
-            if (lenient && CookieHeaderNames.HTTPONLY.equalsIgnoreCase(name)) {
-                continue;
-            }
-
             String value = values.get(i);
             if (value == null) {
                 value = "";

codec-http/src/main/java/io/netty/handler/codec/http/DefaultCookie.java

@@ -15,8 +15,6 @@
  */
 package io.netty.handler.codec.http;
 
-import io.netty.util.internal.CaseIgnoringComparator;
-
 import java.util.Collections;
 import java.util.Set;
 import java.util.TreeSet;
@@ -28,22 +26,6 @@ import java.util.TreeSet;
  */
 public class DefaultCookie implements Cookie {
 
-    private static final Set<String> RESERVED_NAMES = new TreeSet<String>(CaseIgnoringComparator.INSTANCE);
-
-    static {
-        RESERVED_NAMES.add("Domain");
-        RESERVED_NAMES.add("Path");
-        RESERVED_NAMES.add("Comment");
-        RESERVED_NAMES.add("CommentURL");
-        RESERVED_NAMES.add("Discard");
-        RESERVED_NAMES.add("Port");
-        RESERVED_NAMES.add("Max-Age");
-        RESERVED_NAMES.add("Expires");
-        RESERVED_NAMES.add("Version");
-        RESERVED_NAMES.add("Secure");
-        RESERVED_NAMES.add("HTTPOnly");
-    }
-
     private final String name;
     private String value;
     private String domain;
@@ -87,8 +69,8 @@ public class DefaultCookie implements Cookie {
             }
         }
 
-        if (RESERVED_NAMES.contains(name)) {
+        if (name.charAt(0) == '$') {
-            throw new IllegalArgumentException("reserved name: " + name);
+            throw new IllegalArgumentException("name starting with '$' not allowed: " + name);
         }
 
         this.name = name;

codec-http/src/test/java/io/netty/handler/codec/http/CookieDecoderTest.java

@@ -371,4 +371,23 @@ public class CookieDecoderTest {
         Cookie c = cookies.iterator().next();
         assertEquals("timeZoneName=(GMT+04:00) Moscow, St. Petersburg, Volgograd&promocode=&region=BE", c.getValue());
     }
+
+    @Test
+    public void testDecodingWeirdNames1() {
+        String src = "path=; expires=Mon, 01-Jan-1990 00:00:00 GMT; path=/; domain=.www.google.com";
+        Set<Cookie> cookies = new CookieDecoder().decode(src);
+        Cookie c = cookies.iterator().next();
+        assertEquals("path", c.getName());
+        assertEquals("", c.getValue());
+        assertEquals("/", c.getPath());
+    }
+
+    @Test
+    public void testDecodingWeirdNames2() {
+        String src = "HTTPOnly=";
+        Set<Cookie> cookies = new CookieDecoder().decode(src);
+        Cookie c = cookies.iterator().next();
+        assertEquals("HTTPOnly", c.getName());
+        assertEquals("", c.getValue());
+    }
 }