downgrade a public-suffix Domain cookie to host-only

okhttp/src/commonJvmAndroid/kotlin/okhttp3/Cookie.kt

@@ -556,15 +556,19 @@ class Cookie private constructor(
       val urlHost = url.host
       if (domain == null) {
         domain = urlHost
-      } else if (!domainMatch(urlHost, domain)) {
-        return null // No domain match? This is either incompetence or malice!
-      }
+      } else {
+        if (!domainMatch(urlHost, domain)) {
+          return null // No domain match? This is either incompetence or malice!
+        }
 
-      // If the domain is a suffix of the url host, it must not be a public suffix.
-      if (urlHost.length != domain.length &&
-        PublicSuffixDatabase.get().getEffectiveTldPlusOne(domain) == null
-      ) {
-        return null
+        // A public suffix can't be used as a cookie domain. If it's the request host itself the
+        // cookie is downgraded to host-only; if it's a proper suffix of the host it's refused.
+        if (PublicSuffixDatabase.get().getEffectiveTldPlusOne(domain) == null) {
+          if (urlHost.length != domain.length) {
+            return null
+          }
+          hostOnly = true
+        }
       }
 
       // If the path is absent or didn't start with '/', use the default path. It's a string like

okhttp/src/jvmTest/kotlin/okhttp3/CookieTest.kt

@@ -323,6 +323,17 @@ class CookieTest {
     assertThat(parse(punycode, "a=b; domain=xn--8ltr62k.jp")).isNull()
   }
 
+  @Test fun domainEqualToRequestHostThatIsPublicSuffixIsHostOnly() {
+    val url = "https://github.io/".toHttpUrl()
+    val cookie = parse(url, "a=b; domain=github.io")
+    assertThat(cookie).isNotNull()
+    assertThat(cookie!!.hostOnly).isTrue()
+    assertThat(cookie.domain).isEqualTo("github.io")
+    // The cookie stays with the request host and doesn't leak to other hosts under the suffix.
+    assertThat(cookie.matches("https://victim.github.io/".toHttpUrl())).isFalse()
+    assertThat(cookie.matches(url)).isTrue()
+  }
+
   @Test fun hostOnly() {
     assertThat(parse(url, "a=b")!!.hostOnly).isTrue()
     assertThat(