Priority of url-cookie-trusted-urls vs url-cookie-untrusted-urls

Priority of url-cookie-trusted-urls vs url-cookie-untrusted-urls

[T.V Raman]

The URL package has these two custom settings:

url-cookie-trusted-urls
url-cookie-untrusted-urls

both take a list of regex.

From what I observe, if you set url-cookie-untrusted-urls to '(".*"),
then the setting in url-cookie-trusted-urls e.g. '("example.com") has
no effect. This makes it hard to set up emacs/eww to not trust any
domain, and then progressively allow a few domains to set cookies;
could the  priority order of these settings be reversed?

-- 

-- 

Re: Priority of url-cookie-trusted-urls vs url-cookie-untrusted-urls

[Andreas Schwab]

On Jul 31 2020, T.V Raman wrote:

> From what I observe, if you set url-cookie-untrusted-urls to '(".*"),
> then the setting in url-cookie-trusted-urls e.g. '("example.com") has
> no effect. This makes it hard to set up emacs/eww to not trust any
> domain, and then progressively allow a few domains to set cookies;
> could the  priority order of these settings be reversed?

If you set url-cookie-untrusted-urls to ("") it will always be less
specific than any match from url-cookie-trusted-urls.

Andreas.

-- 
Andreas Schwab, schwab@linux-m68k.org
GPG Key fingerprint = 7578 EB47 D4E5 4D69 2510  2552 DF73 E780 A9DA AEC1
"And now for something completely different."

Re: Priority of url-cookie-trusted-urls vs url-cookie-untrusted-urls

[T.V Raman]

Will try that -- might be worth adding this to the docs for those options.
-- 
Id: kg:/m/0285kf1 

-- 
Id: kg:/m/0285kf1 

Re: Priority of url-cookie-trusted-urls vs url-cookie-untrusted-urls

[Stefan Monnier]

>> From what I observe, if you set url-cookie-untrusted-urls to '(".*"),
>> then the setting in url-cookie-trusted-urls e.g. '("example.com") has
>> no effect. This makes it hard to set up emacs/eww to not trust any
>> domain, and then progressively allow a few domains to set cookies;
>> could the  priority order of these settings be reversed?
>
> If you set url-cookie-untrusted-urls to ("") it will always be less
> specific than any match from url-cookie-trusted-urls.

IIUC which one takes precedence depends on the length of the
match, right?  If so, the docstring should say so.


        Stefan

Re: Priority of url-cookie-trusted-urls vs url-cookie-untrusted-urls

[T.V Raman]

Might be better to redo this with a simple filter/unfilter logic
analogous to traditional allow/deny configurations in unix eg
allowed_hosts vs denied_hosts. As it stands, one will always need to
read the source code to know exactly what this does 
Stefan Monnier writes:
 > >> From what I observe, if you set url-cookie-untrusted-urls to '(".*"),
 > >> then the setting in url-cookie-trusted-urls e.g. '("example.com") has
 > >> no effect. This makes it hard to set up emacs/eww to not trust any
 > >> domain, and then progressively allow a few domains to set cookies;
 > >> could the  priority order of these settings be reversed?
 > >
 > > If you set url-cookie-untrusted-urls to ("") it will always be less
 > > specific than any match from url-cookie-trusted-urls.
 > 
 > IIUC which one takes precedence depends on the length of the
 > match, right?  If so, the docstring should say so.
 > 
 > 
 >         Stefan

-- 
Id: kg:/m/0285kf1 

-- 
Id: kg:/m/0285kf1