Merge remote-tracking branch 'origin/jetty-9.4.x' into jetty-10.0.x

jetty-server/src/main/java/org/eclipse/jetty/server/Response.java

@@ -230,26 +230,30 @@ public class Response implements HttpServletResponse
     @Override
     public void addCookie(Cookie cookie)
     {
-        if (StringUtil.isBlank(cookie.getName()))
+        //Servlet Spec 9.3 Include method: cannot set a cookie if handling an include
-            throw new IllegalArgumentException("Cookie.name cannot be blank/null");
+        if (isMutable())
+        {
+            if (StringUtil.isBlank(cookie.getName()))
+                throw new IllegalArgumentException("Cookie.name cannot be blank/null");
 
-        String comment = cookie.getComment();
+            String comment = cookie.getComment();
-        // HttpOnly was supported as a comment in cookie flags before the java.net.HttpCookie implementation so need to check that
+            // HttpOnly was supported as a comment in cookie flags before the java.net.HttpCookie implementation so need to check that
-        boolean httpOnly = cookie.isHttpOnly() || HttpCookie.isHttpOnlyInComment(comment);
+            boolean httpOnly = cookie.isHttpOnly() || HttpCookie.isHttpOnlyInComment(comment);
-        SameSite sameSite = HttpCookie.getSameSiteFromComment(comment);
+            SameSite sameSite = HttpCookie.getSameSiteFromComment(comment);
-        comment = HttpCookie.getCommentWithoutAttributes(comment);
+            comment = HttpCookie.getCommentWithoutAttributes(comment);
 
-        addCookie(new HttpCookie(
+            addCookie(new HttpCookie(
-            cookie.getName(),
+                cookie.getName(),
-            cookie.getValue(),
+                cookie.getValue(),
-            cookie.getDomain(),
+                cookie.getDomain(),
-            cookie.getPath(),
+                cookie.getPath(),
-            cookie.getMaxAge(),
+                cookie.getMaxAge(),
-            httpOnly,
+                httpOnly,
-            cookie.getSecure(),
+                cookie.getSecure(),
-            comment,
+                comment,
-            cookie.getVersion(),
+                cookie.getVersion(),
-            sameSite));
+                sameSite));
+        }
     }
 
     /**
@@ -302,7 +306,6 @@ public class Response implements HttpServletResponse
         addCookie(cookie);
     }
 
-    @Override
     public boolean containsHeader(String name)
     {
         return _fields.contains(name);

jetty-server/src/test/java/org/eclipse/jetty/server/ResponseTest.java

@@ -1094,6 +1094,23 @@ public class ResponseTest
         assertEquals("name=value; Path=/path; Domain=domain; Secure; HttpOnly", set);
     }
     
+    @Test
+    public void testAddCookieInInclude() throws Exception
+    {
+        Response response = getResponse();
+        response.include();
+
+        Cookie cookie = new Cookie("naughty", "value");
+        cookie.setDomain("domain");
+        cookie.setPath("/path");
+        cookie.setSecure(true);
+        cookie.setComment("comment__HTTP_ONLY__");
+
+        response.addCookie(cookie);
+
+        assertNull(response.getHttpFields().get("Set-Cookie"));
+    }
+    
     @Test
     public void testAddCookieSameSiteDefault() throws Exception
     {