[HER-1864] cookies are being set and sent back on TLDs/public-suffixes (like '.com') (sometimes called 'supercookies')

* CookieSpecBase
    use Guava InternetDomainName public-suffixes to both (1) prevent storing cookie on public-suffix; (2) prevent looking-up cookies for public-suffixes
* BdbCookieStorage
    correct checkpoint/relaunch behavior: don't reuse persisted cookies on normal relaunches; do reuse on resume-from-checkpoint

commons/src/main/java/org/apache/commons/httpclient/cookie/CookieSpecBase.java

@@ -45,6 +45,7 @@ import org.apache.commons.httpclient.util.DateUtil;
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 
+import com.google.common.net.InternetDomainName; // <- IA/HERITRIX CHANGE
 import com.sleepycat.collections.StoredIterator; // <- IA/HERITRIX CHANGE
 
 /**
@@ -420,7 +421,26 @@ public class CookieSpecBase implements CookieSpec {
                         "Illegal domain attribute \"" + cookie.getDomain() 
                         + "\". Domain of origin: \"" + host + "\"");
                 }
+            } 
+            // BEGIN IA/HERITRIX ADDITION 
+            else {
+                // requested domain is suffix of origin host; now make sure
+                // it's not a public-suffix
+                String requestedDomain = cookie.getDomain(); 
+                if(requestedDomain.startsWith(".")) {
+                    requestedDomain = requestedDomain.substring(1);
+                }
+                try {
+                    if((InternetDomainName.fromLenient(requestedDomain)).isPublicSuffix()) {
+                        throw new MalformedCookieException(
+                                "Illegal public-suffix domain attribute \"" + cookie.getDomain() 
+                                + "\". Domain of origin: \"" + host + "\"");
+                    }  
+                } catch (IllegalArgumentException e) {
+                    // TODO: consider if this means cookie should be invalid
+                }
             }
+           // END IA/HERITRIX ADDITION 
         } else {
             if (!host.equals(cookie.getDomain())) {
                 throw new MalformedCookieException(
@@ -593,17 +613,21 @@ public class CookieSpecBase implements CookieSpec {
         LOG.trace("enter CookieSpecBase.match("
            + "String, int, String, boolean, SortedMap)");
 
-        // TODO: skip meaningless 'narrowing' when host is a numeric IP
-        // (harmless in the meantime)
-        
         if (cookies == null) {
             return null;
         }
         List matching = new LinkedList();
-        String narrowHost = host;
-        do {
-            Iterator iter = cookies.subMap(narrowHost,
-                    narrowHost + Cookie.DOMAIN_OVERBOUNDS).values().iterator();
+        InternetDomainName domain; 
+        try {
+            domain = InternetDomainName.fromLenient(host); 
+        } catch(IllegalArgumentException e) {
+            domain = null; 
+        }
+        
+        String candidate = (domain!=null) ? domain.toString() : host;
+        while(candidate!=null) {
+            Iterator iter = cookies.subMap(candidate,
+                    candidate + Cookie.DOMAIN_OVERBOUNDS).values().iterator();
             while (iter.hasNext()) {
                 Cookie cookie = (Cookie) (iter.next());
                 if (match(host, port, path, secure, cookie)) {
@@ -611,9 +635,13 @@ public class CookieSpecBase implements CookieSpec {
                 }
             }
             StoredIterator.close(iter);
-            int trimTo = narrowHost.indexOf('.', 1);
-            narrowHost = (trimTo < 0) ? null : narrowHost.substring(trimTo+1);
-        } while (narrowHost != null);
+            if(domain!=null && domain.isUnderPublicSuffix()) {
+                domain = domain.parent(); 
+                candidate = domain.toString(); 
+            } else {
+                candidate = null;
+            }
+        }
 
         return (Cookie[]) matching.toArray(new Cookie[matching.size()]); 
     }