From cc6780a5bc3c30c62454ba27eb2bed52534c7f0a Mon Sep 17 00:00:00 2001
From: Akinori MUSHA <knu@idaemons.org>
Date: Tue, 19 Mar 2013 22:54:05 +0900
Subject: [PATCH] A relative path must be treated as the root path as per RFC
 6265 5.1.4.

---
 lib/http/cookie.rb       | 20 +++++++++-----------
 test/test_http_cookie.rb | 11 ++++++++++-
 2 files changed, 19 insertions(+), 12 deletions(-)

diff --git a/lib/http/cookie.rb b/lib/http/cookie.rb
index 7e280ab..23493e5 100644
--- a/lib/http/cookie.rb
+++ b/lib/http/cookie.rb
@@ -137,17 +137,15 @@ class HTTP::Cookie
   alias for_domain? for_domain
 
   class << self
-    # Normalizes a given path.  If it is empty, the root path '/' is
-    # returned.  If a URI object is given, returns a new URI object
-    # with the path part normalized.
-    def normalize_path(uri)
-      # Currently does not replace // to /
-      case uri
-      when URI
-        uri.path.empty? ? uri + '/' : uri
-      else
-        uri.empty? ? '/' : uri
-      end
+    # Normalizes a given path.  If it is empty or it is a relative
+    # path, the root path '/' is returned.
+    #
+    # If a URI object is given, returns a new URI object with the path
+    # part normalized.
+    def normalize_path(path)
+      return path + normalize_path(path.path) if URI === path
+      # RFC 6265 5.1.4
+      path.start_with?('/') ? path : '/'
     end
 
     # Parses a Set-Cookie header value +set_cookie+ into an array of
diff --git a/test/test_http_cookie.rb b/test/test_http_cookie.rb
index 5ff216b..ad5866d 100644
--- a/test/test_http_cookie.rb
+++ b/test/test_http_cookie.rb
@@ -248,12 +248,14 @@ class TestHTTPCookie < Test::Unit::TestCase
       "no_path1=no_path; Expires=Sun, 06 Nov 2011 00:29:52 GMT, no_expires=nope; Path=/, " \
       "no_path2=no_path; Expires=Sun, 06 Nov 2011 00:29:52 GMT; no_expires=nope; Path, " \
       "no_path3=no_path; Expires=Sun, 06 Nov 2011 00:29:52 GMT; no_expires=nope; Path=, " \
+      "rel_path1=rel_path; Expires=Sun, 06 Nov 2011 00:29:52 GMT; no_expires=nope; Path=foo/bar, " \
+      "rel_path1=rel_path; Expires=Sun, 06 Nov 2011 00:29:52 GMT; no_expires=nope; Path=foo, " \
       "no_domain1=no_domain; Expires=Sun, 06 Nov 2011 00:29:53 GMT; no_expires=nope, " \
       "no_domain2=no_domain; Expires=Sun, 06 Nov 2011 00:29:53 GMT; no_expires=nope; Domain, " \
       "no_domain3=no_domain; Expires=Sun, 06 Nov 2011 00:29:53 GMT; no_expires=nope; Domain="
 
     cookies = HTTP::Cookie.parse cookie_str, :origin => url
-    assert_equal 13, cookies.length
+    assert_equal 15, cookies.length
 
     name = cookies.find { |c| c.name == 'name' }
     assert_equal "Aaron",             name.value
@@ -277,6 +279,13 @@ class TestHTTPCookie < Test::Unit::TestCase
       assert_equal Time.at(1320539392), c.expires, c.name
     }
 
+    rel_path_cookies = cookies.select { |c| c.value == 'rel_path' }
+    assert_equal 2, rel_path_cookies.size
+    rel_path_cookies.each { |c|
+      assert_equal "/",                 c.path,    c.name
+      assert_equal Time.at(1320539392), c.expires, c.name
+    }
+
     no_domain_cookies = cookies.select { |c| c.value == 'no_domain' }
     assert_equal 3, no_domain_cookies.size
     no_domain_cookies.each { |c|