Re: lynx-dev Accepting invalid cookies - was: cookie bug (not in lynx)

[brian j. pardy]

On Tue, 29 Dec 1998, I wrote:

> I'm about halfway through implementing a skeleton of (2), enough to 
> provide an extra attribute which can then be checked once each test is
> hashed out as to which we want to ignore for cookie swith this flag.
>
> [...]
> 
> What I presently have (patch will be at [0] in about 10 minutes, if you're
> interested) makes an option for lynx.cfg and .lynxrc in the same style as 
> COOKIE_ACCEPT_DOMAINS (ie, just a big list) which is checked (not securely
> yet, I want to do this as a domain attribute instead of basically a list
> being grepped) when a new cookie comes across.
> 
> As for being more restrictive than 2.8.1, I'm all for it after thinking this
> over again.

It looks like my idea won't work without some more changes.

I vaguely remembered the bitflags that were being used in cookies to 
specify secure/discard/persistent/etc and attributed those to the
domain_entry struct in my head.

From LYCookie.h:

    struct _domain_entry {
        char *      domain;  /* Domain for which these cookies are valid */
        behaviour   bv;
        HTList *    cookie_list;
    };
    typedef struct _domain_entry domain_entry;

Any ideas?  I have an idea for adding a flags int similar to that in the
cookie struct, but if someone has a better thought...

-- 
GPG & PGP public keys: <URL:http://www.psnw.com/~posterkid/keys/> 
PGP fingerprint: 42 57 B3 D2 39 8E 74 C3  5E 4D AC 43 25 D2 26 D4