From: Daniel Stenberg <daniel@haxx.se>
Date: Sat, 16 May 2026 00:19:09 +0200
Subject: [PATCH] cookie: trim trailing dots when checking PSL

Verified with test 1629

Closes #21636

Backported-by: Rafael Passos <rafael@rcpassos.me>
 * changes to tests/data/Makefile.am:
    - new test case test1629,
    - the upstream patch has more unrelated tests not
      present in this patch, they had to be removed
* test1629: replace crlf="headers" -> crlf="yes"
  so the 8.14.1 test runner correctly applies CRLF to header.

Signed-off-by: Rafael Passos <rafael@rcpassos.me>
---
 lib/cookie.c                      | 13 +++++++++++--
 tests/data/Makefile.am            |  1 +
 tests/data/{test2504 => test1629} | 29 +++++++++++++++--------------
 3 files changed, 27 insertions(+), 16 deletions(-)
 copy tests/data/{test2504 => test1629} (50%)

diff --git a/lib/cookie.c b/lib/cookie.c
index bfdd4ad..062d7aa 100644
--- a/lib/cookie.c
+++ b/lib/cookie.c
@@ -907,12 +907,21 @@ is_public_suffix(struct Curl_easy *data,
     char lcookie[256];
     size_t dlen = strlen(domain);
     size_t clen = strlen(co->domain);
+
+    /* trim trailing dots */
+    if(dlen && (domain[dlen - 1] == '.'))
+      dlen--;
+    if(clen && (co->domain[clen - 1] == '.'))
+      clen--;
+
     if((dlen < sizeof(lcase)) && (clen < sizeof(lcookie))) {
       const psl_ctx_t *psl = Curl_psl_use(data);
       if(psl) {
         /* the PSL check requires lowercase domain name and pattern */
-        Curl_strntolower(lcase, domain, dlen + 1);
-        Curl_strntolower(lcookie, co->domain, clen + 1);
+        Curl_strntolower(lcase, domain, dlen);
+        lcase[dlen] = 0;
+        Curl_strntolower(lcookie, co->domain, clen);
+        lcookie[clen] = 0;
         acceptable = psl_is_cookie_domain_acceptable(psl, lcase, lcookie);
         Curl_psl_release(data);
       }
diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am
index 7e4163d..b7e60f7 100644
--- a/tests/data/Makefile.am
+++ b/tests/data/Makefile.am
@@ -218,6 +218,7 @@ test1608 test1609 test1610 test1611 test1612 test1613 test1614 test1615 \
 test1616 \
 test1620 test1621 \
 \
+test1629 \
 test1630 test1631 test1632 test1633 test1634 test1635 \
 \
 test1650 test1651 test1652 test1653 test1654 test1655 test1656 test1657 \
diff --git a/tests/data/test2504 b/tests/data/test1629
similarity index 50%
copy from tests/data/test2504
copy to tests/data/test1629
index 704701c..5d9c552 100644
--- a/tests/data/test2504
+++ b/tests/data/test1629
@@ -3,36 +3,35 @@
 <info>
 <keywords>
 HTTP
-cookies
+HTTP GET
 </keywords>
 </info>
 
 # Server-side
 <reply>
-<data crlf="yes" nocheck="yes">
+<data crlf="yes">
 HTTP/1.1 200 OK
-Date: Tue, 09 Nov 2010 14:49:00 GMT
-Server: server.example.com
-Content-Length: 47
-Set-Cookie: sid=SECRET123; Path=/
+Content-Length: 6
+Set-Cookie: something=1; Domain=co.uk.; Path=/
 
-file contents should appear once for each file
+-foo-
 </data>
 </reply>
 
 # Client-side
 <client>
+<features>
+PSL
+cookies
+</features>
 <server>
 http
 </server>
-<tool>
-lib%TESTNUMBER
-</tool>
 <name>
-custom Host with cookie, handle reuse, no custom Host:
+cookies with trailing dot after PSL domain
 </name>
 <command>
-http://%HOSTIP:%HTTPPORT
+http://foo.co.uk.:%HTTPPORT/ http://bar.co.uk.:%HTTPPORT/ -b "" --resolve foo.co.uk.:%HTTPPORT:%HOSTIP --resolve bar.co.uk.:%HTTPPORT:%HOSTIP
 </command>
 </client>
 
@@ -40,11 +39,13 @@ http://%HOSTIP:%HTTPPORT
 <verify>
 <protocol crlf="yes">
 GET / HTTP/1.1
-Host: victim.internal
+Host: foo.co.uk.:%HTTPPORT
+User-Agent: curl/%VERSION
 Accept: */*
 
 GET / HTTP/1.1
-Host: %HOSTIP:%HTTPPORT
+Host: bar.co.uk.:%HTTPPORT
+User-Agent: curl/%VERSION
 Accept: */*
 
 </protocol>