Strip leading . from cookie domain names.

CHANGES.rst

@@ -16,7 +16,7 @@ https://github.com/zopefoundation/Zope/blob/4.x/CHANGES.rst
 
 - Quote all components of a redirect URL (not only the path component)
   (`#1027 <https://github.com/zopefoundation/Zope/issues/1027>`_)
-  
+
 - Drop the convenience script generation from the buildout configuration
   in order to get rid of a lot of dependency version pins.
   These were only needed for maintainers who can install them manually.
@@ -28,6 +28,9 @@ https://github.com/zopefoundation/Zope/blob/4.x/CHANGES.rst
   to the complete matrix view when more than 30 roles are defined.
   (`#1039 <https://github.com/zopefoundation/Zope/pull/1039>`_)
 
+- Strip leading ``.`` in cookie domain names.
+  (`#1041 <https://github.com/zopefoundation/Zope/pull/1041>`_)
+
 
 5.5.1 (2022-04-05)
 ------------------

src/ZPublisher/cookie.py

@@ -242,6 +242,10 @@ def domain_converter(value):
         return value
     from encodings.idna import ToASCII
     from encodings.idna import nameprep
+    # According to https://www.rfc-editor.org/rfc/rfc6265#section-4.1.2.3 a
+    # leading dot is ignored. If it is there `ToASCII` breaks on the empty
+    # string:
+    u_value = u_value.lstrip('.')
     return ".".join(to_str(ToASCII(nameprep(c))) for c in u_value.split("."))
 
 

src/ZPublisher/tests/test_cookie.py

@@ -145,6 +145,10 @@ def test_domain(self):
         _, v = convertCookieParameter("domain",
                                       "Fußball.example".encode())
         self.assertEqual(v, "fussball.example")
+        # a leading dot is stripped as it is ignored according to
+        # https://www.rfc-editor.org/rfc/rfc6265#section-4.1.2.3
+        _, v = convertCookieParameter("domain", ".zope.dev")
+        self.assertEqual(v, "zope.dev")
 
     def test_path(self):
         # test object