CookieJar.php

<?php
/*
 * Copyright © 2003-2010, The ESUP-Portail consortium & the JA-SIG Collaborative.
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions are met:
 *
 *     * Redistributions of source code must retain the above copyright notice,
 *       this list of conditions and the following disclaimer.
 *     * Redistributions in binary form must reproduce the above copyright notice,
 *       this list of conditions and the following disclaimer in the documentation
 *       and/or other materials provided with the distribution.
 *     * Neither the name of the ESUP-Portail consortium & the JA-SIG
 *       Collaborative nor the names of its contributors may be used to endorse or
 *       promote products derived from this software without specific prior
 *       written permission.

 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
 * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
 * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
 * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
 * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */

include_once(dirname(__FILE__) . '/InvalidArgumentException.php');

/**
 * This class provides access to service cookies and handles parsing of response
 * headers to pull out cookie values.
 *
 */
class CAS_CookieJar {

	private $_cookies;

	/**
	 * Create a new cookie jar by passing it a reference to an array in which it
	 * should store cookies.
	 *
	 * @param ref array $storageArray
	 * @return void
	 */
	public function __construct (array &$storageArray) {
		$this->_cookies =& $storageArray;
	}

	/**
	 * Store cookies for a web service request.
	 * Cookie storage is based on RFC 2965: http://www.ietf.org/rfc/rfc2965.txt
	 *
	 * @param string $request_url The URL that generated the response headers.
	 * @param array $response_headers An array of the HTTP response header strings.
	 *
	 * @return void
	 *
	 * @access private
	 */
	public function storeCookies ($request_url, $response_headers) {
		$urlParts = parse_url($request_url);
		$defaultDomain = $urlParts['host'];

		$cookies = $this->parseCookieHeaders($response_headers, $defaultDomain);

		// var_dump($cookies);
		foreach ($cookies as $cookie) {
			// Enforce the same-origin policy by verifying that the cookie
			// would match the url that is setting it
			if (!$this->cookieMatchesTarget($cookie, $urlParts))
				continue;

			// store the cookie
			$this->storeCookie($cookie);

			phpCAS::trace($cookie['name'].' -> '.$cookie['value']);
		}
	}

	/**
	 * Retrieve cookies applicable for a web service request.
	 * Cookie applicability is based on RFC 2965: http://www.ietf.org/rfc/rfc2965.txt
	 *
	 * @param string $request_url The url that the cookies will be for.
	 *
	 * @return array An array containing cookies. E.g. array('name' => 'val');
	 *
	 * @access private
	 */
	public function getCookies ($request_url) {
		if (!count($this->_cookies))
			return array();

		// If our request URL can't be parsed, no cookies apply.
		$target = parse_url($request_url);
		if ($target === FALSE)
			return array();

		$this->expireCookies();

		$matching_cookies = array();
		foreach ($this->_cookies as $key => $cookie) {
			if ($this->cookieMatchesTarget($cookie, $target)) {
				$matching_cookies[$cookie['name']] = $cookie['value'];
			}
		}
		return $matching_cookies;
	}


	/**
	 * Parse Cookies without PECL
	 * From the comments in http://php.net/manual/en/function.http-parse-cookie.php
	 * @param array $header 	An array of header lines.
	 * @param string $defaultDomain 	The domain to use if none is specified in the cookie.
	 * @return array of cookies
	 */
	protected function parseCookieHeaders( $header, $defaultDomain ) {
		phpCAS::traceBegin();
		$cookies = array();
		foreach( $header as $line ) {
			if( preg_match( '/^Set-Cookie2?: /i', $line ) ) {
				$cookies[] = $this->parseCookieHeader($line, $defaultDomain);
			}
		}

		phpCAS::traceEnd($cookies);
		return $cookies;
	}

	/**
	 * Parse a single cookie header line.
	 *
	 * Based on RFC2965 http://www.ietf.org/rfc/rfc2965.txt
	 *
	 * @param string $line The header line.
	 * @param string $defaultDomain The domain to use if none is specified in the cookie.
	 * @return array
	 */
	protected function parseCookieHeader ($line, $defaultDomain) {
		if (!$defaultDomain)
			throw new CAS_InvalidArgumentException('$defaultDomain was not provided.');

		// Set our default values
		$cookie = array(
			'domain' => $defaultDomain,
			'path' => '/',
			'secure' => false,
		);

		$line = preg_replace( '/^Set-Cookie2?: /i', '', trim( $line ) );

		// trim any trailing semicolons.
		$line = trim($line, ';');

		phpCAS::trace("Cookie Line: $line");

		// This implementation makes the assumption that semicolons will not
		// be present in quoted attribute values. While attribute values that
		// contain semicolons are allowed by RFC2965, they are hopefully rare
		// enough to ignore for our purposes. Most browsers make the same 
		// assumption.
		$attributeStrings = explode( ';', $line );

		foreach( $attributeStrings as $attributeString ) {
			// split on the first equals sign and use the rest as value
			$attributeParts = explode( '=', $attributeString, 2);

			$attributeName = trim($attributeParts[0]);
			$attributeNameLC = strtolower($attributeName);

			if (isset($attributeParts[1])) {
				$attributeValue = trim($attributeParts[1]);
				// Values may be quoted strings.
				if (strpos($attributeValue, '"') === 0) {
					$attributeValue = trim($attributeValue, '"');
					// unescape any escaped quotes:
					$attributeValue = str_replace('\"', '"', $attributeValue);
				}
			} else {
				$attributeValue = null;
			}

			switch ($attributeNameLC) {
				case 'expires':
					$cookie['expires'] = strtotime($attributeValue);
					break;
				case 'max-age':
					$cookie['max-age'] = (int)$attributeValue;
					// Set an expiry time based on the max-age
					if ($cookie['max-age'])
						$cookie['expires'] = time() + $cookie['max-age'];
					// If max-age is zero, then the cookie should be removed imediately
					// so set an expiry before now.
					else
						$cookie['expires'] = time() - 1;
					break;
				case 'secure':
					$cookie['secure'] = true;
					break;
				case 'domain':
				case 'path':
				case 'port':
				case 'version':
				case 'comment':
				case 'commenturl':
				case 'discard':
				case 'httponly':
					$cookie[$attributeNameLC] = $attributeValue;
					break;
				default:
					$cookie['name'] = $attributeName;
					$cookie['value'] = $attributeValue;
			}
		}

		return $cookie;
	}

	/**
	 * Add, update, or remove a cookie.
	 *
	 * @param array $cookie A cookie array as created by parseCookieHeaders()
	 *
	 * @return void
	 *
	 * @access private
	 */
	protected function storeCookie ($cookie) {
		// Discard any old versions of this cookie.
		$this->discardCookie($cookie);
		$this->_cookies[] = $cookie;

	}

	/**
	 * Discard an existing cookie
	 *
	 * @param stdClass $cookie
	 *
	 * @return void
	 *
	 * @access private
	 */
	protected function discardCookie ($cookie) {
		if (!isset($cookie['domain']) || !isset($cookie['path']) || !isset($cookie['path']))
			throw new CAS_InvalidArgumentException('Invalid Cookie array passed.');

		foreach ($this->_cookies as $key => $old_cookie) {
			if ($cookie['domain'] == $old_cookie['domain']
			&& $cookie['path'] == $old_cookie['path']
			&& $cookie['name'] == $old_cookie['name'])
			{
				unset($this->_cookies[$key]);
			}
		}
	}

	/**
	 * Go through our stored cookies and remove any that are expired.
	 *
	 * @return void
	 *
	 * @access private
	 */
	protected function expireCookies () {
		foreach ($this->_cookies as $key => $cookie) {
			if (isset($cookie['expires']) && $cookie['expires'] < time()) {
				unset($this->_cookies[$key]);
			}
		}
	}

	/**
	 * Answer true if cookie is applicable to a target.
	 *
	 * @param array $cookie An array of cookie attributes.
	 * @param array $target An array of URL attributes as generated by parse_url().
	 *
	 * @return boolean
	 *
	 * @access private
	 */
	protected function cookieMatchesTarget ($cookie, $target) {
		if (!is_array($target))
			throw new CAS_InvalidArgumentException('$target must be an array of URL attributes as generated by parse_url().');
		if (!isset($target['host']))
			throw new CAS_InvalidArgumentException('$target must be an array of URL attributes as generated by parse_url().');

		// Verify that the scheme matches
		if ($cookie['secure'] && $target['scheme'] != 'https')
		return false;
		
		// Verify that the host matches
		// Match domain and mulit-host cookies
		if (strpos($cookie['domain'], '.') === 0) {
			// check that the target host a.b.c.edu is within .b.c.edu
			$pos = strripos($target['host'], $cookie['domain']);
			if (!$pos)
			return false;
			// verify that the cookie domain is the last part of the host.
			if ($pos + strlen($cookie['domain']) != strlen($target['host']))
			return false;
		}
		// If the cookie host doesn't begin with '.', the host must case-insensitive
		// match exactly
		else {
			if (strcasecmp($target['host'], $cookie['domain']) !== 0)
			return false;
		}

		// Verify that the port matches
		if (isset($cookie['ports']) && !in_array($target['port'], $cookie['ports']))
		return false;

		// Verify that the path matches
		if (strpos($target['path'], $cookie['path']) !== 0)
		return false;

		return true;
	}

}

?>