bvandeusen
2394e47370
Operator-flagged 2026-05-27: HF source check 401'd on
`HEAD /?enterAgree=1` even with valid login cookies. Root cause is the
combination of (1) gallery-dl's HF extractor checking
`self.cookies.get("PHPSESSID", domain="www.hentai-foundry.com")` with
`requests`' EXACT domain matching, and (2) the extension's cookies.js
forcibly rewriting every captured cookie to a leading-dot subdomain-wide
form. HF's PHPSESSID is browser-stored as host-only on
`www.hentai-foundry.com`; the rewrite re-anchored it to
`.hentai-foundry.com`, which `cookies.get(...)` no longer matches even
though the cookie is still sent on actual HTTP requests (RFC 6265
subdomain rules). The extractor falls into its unauthenticated
`?enterAgree=1` fallback, which 401s (Cloudflare or HF's anti-bot HEAD
gating).
Two-part fix, no operator action required for existing stored cookies:
1. **Backend** (`credential_service._augment_cookies`) — refactored from
the subscribestar-only single function into a per-platform dispatcher.
New `_augment_hentaifoundry` parses the materialized netscape file
and, for each `.hentai-foundry.com` entry whose name is PHPSESSID or
YII_CSRF_TOKEN, appends a host-only duplicate
(`www.hentai-foundry.com\tFALSE\t...`). Originals preserved. Three
new tests pin: injection fires + originals preserved; idempotent
when host-only already exists; doesn't touch unrelated cookies
(e.g. `_ga`).
2. **Extension** (`cookies.js`) — `toNetscapeFormat` now respects
`c.hostOnly` from the browser instead of blindly forcing a
leading-dot subdomain-wide form. Host-only cookies are written with
the bare host + FALSE flag; non-host-only cookies retain the
leading-dot + TRUE form. Forward-compat — fresh captures from
v1.0.5+ no longer need the backend's host-only duplication.
Extension bumped 1.0.4 → 1.0.5; manifest + package.json in lockstep.
After deploy: the next HF source check on the operator's already-stored
cookies will succeed because the materialized cookies.txt now contains
host-only PHPSESSID. No browser re-export needed.
79 lines
2.7 KiB
JavaScript
79 lines
2.7 KiB
JavaScript
/**
|
|
* Cookie extraction + Netscape format conversion.
|
|
* Direct port of GS extension/lib/cookies.js.
|
|
*/
|
|
|
|
async function extractCookiesForPlatform(platformKey) {
|
|
const platform = PLATFORMS[platformKey];
|
|
if (!platform) throw new Error(`Unknown platform: ${platformKey}`);
|
|
|
|
const all = [];
|
|
for (const domain of platform.domains) {
|
|
try {
|
|
const cookies = await browser.cookies.getAll({ domain });
|
|
all.push(...cookies);
|
|
} catch (e) {
|
|
console.warn(`cookies.getAll failed for ${domain}:`, e);
|
|
}
|
|
}
|
|
return deduplicateCookies(all);
|
|
}
|
|
|
|
function deduplicateCookies(cookies) {
|
|
const seen = new Map();
|
|
for (const c of cookies) {
|
|
const key = `${c.name}|${c.domain}|${c.path}`;
|
|
if (!seen.has(key)) {
|
|
seen.set(key, c);
|
|
} else {
|
|
const existing = seen.get(key);
|
|
if (c.expirationDate && (!existing.expirationDate || c.expirationDate > existing.expirationDate)) {
|
|
seen.set(key, c);
|
|
}
|
|
}
|
|
}
|
|
return Array.from(seen.values());
|
|
}
|
|
|
|
function toNetscapeFormat(cookies) {
|
|
const lines = ['# Netscape HTTP Cookie File'];
|
|
for (const c of cookies) {
|
|
// Preserve the browser's actual scope. Earlier versions rewrote
|
|
// every cookie to a leading-dot subdomain-wide form, which broke
|
|
// gallery-dl's HF extractor: its `cookies.get(name,
|
|
// domain="www.hentai-foundry.com")` does EXACT domain matching and
|
|
// missed host-only PHPSESSID rewritten to `.hentai-foundry.com`.
|
|
// Operator-flagged 2026-05-27. Backend `_augment_cookies` covers
|
|
// the already-stored cookies; this fix is forward-compat for fresh
|
|
// captures.
|
|
//
|
|
// Cookie storage semantics (Firefox):
|
|
// c.hostOnly === true → cookie set without a Domain= attribute;
|
|
// applies to the exact host only.
|
|
// c.hostOnly === false → cookie set with Domain=X; applies to
|
|
// that domain and its subdomains.
|
|
//
|
|
// Netscape format:
|
|
// leading-dot domain + TRUE flag → subdomain-wide
|
|
// bare-host domain + FALSE flag → host-only
|
|
const hostOnly = c.hostOnly === true;
|
|
let domain = c.domain;
|
|
if (!hostOnly && !domain.startsWith('.')) {
|
|
domain = '.' + domain;
|
|
}
|
|
const subdomainFlag = hostOnly ? 'FALSE' : 'TRUE';
|
|
const secure = c.secure ? 'TRUE' : 'FALSE';
|
|
const expiration = c.expirationDate ? Math.floor(c.expirationDate) : 0;
|
|
lines.push([domain, subdomainFlag, c.path || '/', secure, String(expiration), c.name, c.value].join('\t'));
|
|
}
|
|
return lines.join('\n');
|
|
}
|
|
|
|
async function getCookieCount(platformKey) {
|
|
try {
|
|
return (await extractCookiesForPlatform(platformKey)).length;
|
|
} catch {
|
|
return 0;
|
|
}
|
|
}
|