Close three ways past the public suffix check

The check landed in 2.16.1 with three gaps, none of them a regression but none closed either.

The list algorithm ends by applying a default rule of "*", which was not implemented, so a single
label matching no rule was not a suffix. That accepted a Domain naming any of the eight top level
domains carrying only a wildcard rule, ck and jm among them.

The check lowercased with Locale.ROOT but its caller folded the request host and the Domain with the
default locale, so an uppercase pair walked past it under a Turkish locale.

Section 5.3 step 5.1.1 keeps a cookie whose Domain equals the request host but makes it host-only.
Keeping it as a domain cookie let a host that is itself a public suffix set a cookie every host
beneath it receives.

Author: hyperxpro

client/src/main/java/org/asynchttpclient/cookie/PublicSuffixList.java

@@ -119,6 +119,13 @@ public static boolean isPublicSuffix(String domain) {
       // A wildcard rule such as *.ck makes every direct child of ck a suffix, so the candidate is one
       // when its parent carries the rule.
       int dot = candidate.indexOf('.');
-      return dot > 0 && WILDCARD.contains(candidate.substring(dot + 1));
+      if (dot > 0) {
+        return WILDCARD.contains(candidate.substring(dot + 1));
+      }
+      // No rule matched a single label. The algorithm in the list specification ends by applying a default
+      // rule of "*", which makes any such label a public suffix. That covers the top level domains carrying
+      // only a wildcard rule and no rule of their own, ck and jm among them, and any delegated after this
+      // copy of the list was taken.
+      return true;
   }
 }

client/src/main/java/org/asynchttpclient/cookie/ThreadSafeCookieStore.java

@@ -105,7 +105,7 @@ public Map<String, Map<CookieKey, StoredCookie>> getUnderlying() {
   }
 
   private String requestDomain(Uri requestUri) {
-    return requestUri.getHost().toLowerCase();
+    return requestUri.getHost().toLowerCase(Locale.ROOT);
   }
 
   private String requestPath(Uri requestUri) {
@@ -116,7 +116,7 @@ private String requestPath(Uri requestUri) {
   // Let cookie-domain be the attribute-value without the leading %x2E (".") character.
   private AbstractMap.SimpleEntry<String, Boolean> cookieDomain(String cookieDomain, String requestDomain) {
     if (cookieDomain != null) {
-      String normalizedCookieDomain = cookieDomain.toLowerCase();
+      String normalizedCookieDomain = cookieDomain.toLowerCase(Locale.ROOT);
       return new AbstractMap.SimpleEntry<>(
               (!cookieDomain.isEmpty() && cookieDomain.charAt(0) == '.') ?
                       normalizedCookieDomain.substring(1) :
@@ -185,8 +185,14 @@ private void add(String requestDomain, String requestPath, Cookie cookie) {
     // The step also keeps a cookie whose Domain equals the request host, as a host-only cookie. Dropping
     // it would break ordinary single-label hosts: dev, app, box and cloud are ICANN suffixes as well as
     // the short names Docker Compose and Kubernetes hand out.
-    if (!hostOnly && PublicSuffixList.isPublicSuffix(keyDomain) && !keyDomain.equals(requestDomain)) {
-      return;
+    if (!hostOnly && PublicSuffixList.isPublicSuffix(keyDomain)) {
+      if (!keyDomain.equals(requestDomain)) {
+        return;
+      }
+      // Step 5.1.1: when the Domain names the request host itself the cookie is kept, but as a host-only
+      // cookie. Keeping it as a domain cookie would let a host that is itself a public suffix, which the
+      // single-label gTLDs in container and corporate DNS are, set a cookie every host beneath it receives.
+      hostOnly = true;
     }
 
     String keyPath = cookiePath(cookie.path(), requestPath);

client/src/test/java/org/asynchttpclient/cookie/PublicSuffixCookieTest.java

@@ -110,6 +110,47 @@ public void matchingDoesNotDependOnTheDefaultLocale() {
         }
     }
 
+    /**
+     * The list algorithm ends by applying a default rule of {@code *}, so a single label that matches
+     * nothing is still a public suffix. Without it the eight top-level domains carrying only a wildcard
+     * rule, ck and jm among them, were accepted as a Domain.
+     */
+    @Test
+    public void aTopLevelDomainWithOnlyAWildcardRuleIsStillASuffix() {
+        for (String tld : new String[]{"ck", "er", "fk", "jm", "kh", "mm", "np", "pg"}) {
+            assertTrue(PublicSuffixList.isPublicSuffix(tld), tld + " must be treated as a public suffix");
+        }
+        assertFalse(reaches("evil.foo.ck", "ck", "bank.foo.ck"),
+                "a host under a wildcard-only TLD must not set a cookie for the TLD");
+    }
+
+    /**
+     * The uppercase form must be caught too. The check itself lowercases with Locale.ROOT, but the store
+     * folds the host and the Domain before calling it, and doing that with the default locale let an
+     * uppercase pair through under Turkish.
+     */
+    @Test
+    public void anUppercaseDomainIsCaughtWhateverTheLocale() {
+        Locale original = Locale.getDefault();
+        try {
+            Locale.setDefault(new Locale("tr", "TR"));
+            assertFalse(reaches("EVIL.CO.IN", "CO.IN", "BANK.CO.IN"),
+                    "an uppercase host and Domain must not bypass the check under a Turkish locale");
+        } finally {
+            Locale.setDefault(original);
+        }
+    }
+
+    /**
+     * Step 5.1.1 keeps such a cookie as host-only, so it must not reach hosts beneath the suffix.
+     */
+    @Test
+    public void aHostNamedAfterASuffixSetsAHostOnlyCookie() {
+        assertTrue(reaches("dev", "dev", "dev"), "the host itself must still receive its own cookie");
+        assertFalse(reaches("dev", "dev", "victim.dev"),
+                "a host that is itself a public suffix must not set a cookie for everything beneath it");
+    }
+
     @Test
     public void theListRecognisesSuffixesAndRegistrableDomains() {
         assertTrue(PublicSuffixList.isPublicSuffix("co.uk"));