Repository: jhy/jsoup
Pull request #2220 (2024-11-04 23:25:11)

Bump org.apache.maven.plugins:maven-surefire-plugin from 3.5.0 to 3.5.2
Bumps [org.apache.maven.plugins:maven-surefire-plugin](https://github.com/apache/maven-surefire) from 3.5.0 to 3.5.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/apache/maven-surefire/releases">org.apache.maven.plugins:maven-surefire-plugin's releases</a>.</em></p>
<blockquote>
<h2>3.5.2</h2>
<!-- raw HTML omitted -->
<h2>🚀 New features and improvements</h2>
<ul>
<li><a href="https://issues.apache.org/jira/browse/SUREFIRE-2278">[SUREFIRE-2278]</a> - Don't say please. (<a href="https://redirect.github.com/apache/maven-surefire/pull/792">#792</a>) <a href="https://github.com/elharo"><code>@​elharo</code></a></li>
</ul>
<h2>📦 Dependency updates</h2>
<ul>
<li><a href="https://issues.apache.org/jira/browse/SUREFIRE-2281">[SUREFIRE-2281]</a> - Doxia 2.0.0 ga (<a href="https://redirect.github.com/apache/maven-surefire/pull/794">#794</a>) <a href="https://github.com/michael-o"><code>@​michael-o</code></a></li>
<li>Bump commons-io:commons-io from 2.2 to 2.14.0 in /surefire-its/src/test/resources/surefire-979-smartStackTrace-wrongClassloader/module1 (<a href="https://redirect.github.com/apache/maven-surefire/pull/789">#789</a>) <a href="https://github.com/dependabot"><code>@​dependabot</code></a></li>
</ul>
<h2>👻 Maintenance</h2>
<ul>
<li><a href="https://issues.apache.org/jira/browse/SUREFIRE-2282">[SUREFIRE-2282]</a> - surefire-report-plugin: Update Introduction documenta… (<a href="https://redirect.github.com/apache/maven-surefire/pull/796">#796</a>) <a href="https://github.com/michael-o"><code>@​michael-o</code></a></li>
<li>Reduce cyclomatic complexity (<a href="https://redirect.github.com/apache/maven-surefire/pull/793">#793</a>) <a href="https://github.com/elharo"><code>@​elharo</code></a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/apache/maven-surefire/compare/surefire-3.5.1...surefire-3.5.2">https://github.com/apache/maven-surefire/compare/surefire-3.5.1...surefire-3.5.2</a></p>
<h2>3.5.1</h2>
<!-- raw HTML omitted -->
<h2>🚀 New features and improvements</h2>
<ul>
<li><a href="https://issues.apache.org/jira/browse/SUREFIRE-2270">[SUREFIRE-2270]</a> - Use JUnit5 in surefire-shadefire (<a href="https://redirect.github.com/apache/maven-surefire/pull/783">#783</a>) <a href="https://github.com/slawekjaranowski"><code>@​slawekjaranowski</code></a></li>
<li><a href="https://issues.apache.org/jira/browse/SUREFIRE-2266">[SUREFIRE-2266]</a> - Execute ITs in parallel (<a href="https://redirect.github.com/apache/maven-surefire/pull/781">#781</a>) <a href="https://github.com/slawekjaranowski"><code>@​slawekjaranowski</code></a></li>
<li><a href="https://issues.apache.org/jira/browse/SUREFIRE-2264">[SUREFIRE-2264]</a> - Limit usage of commons-io from surefire-shared-utils (<a href="https://redirect.github.com/apache/maven-surefire/pull/777">#777</a>) <a href="https://github.com/slawekjaranowski"><code>@​slawekjaranowski</code></a></li>
</ul>
<h2>🐛 Bug Fixes</h2>
<ul>
<li><a href="https://issues.apache.org/jira/browse/SUREFIRE-2267">[SUREFIRE-2267]</a> - Packages for commons-codec should be relocated in surefire-shared-utils (<a href="https://redirect.github.com/apache/maven-surefire/pull/782">#782</a>) <a href="https://github.com/slawekjaranowski"><code>@​slawekjaranowski</code></a></li>
<li><a href="https://issues.apache.org/jira/browse/SUREFIRE-1737">[SUREFIRE-1737]</a> - Fix disable in statelessTestsetReporter (<a href="https://redirect.github.com/apache/maven-surefire/pull/780">#780</a>) <a href="https://github.com/slawekjaranowski"><code>@​slawekjaranowski</code></a></li>
<li><a href="https://issues.apache.org/jira/browse/SUREFIRE-2257">[SUREFIRE-2257]</a> - [REGRESSION] NPEx: Cannot invoke &quot;Object.toString()&quot; … (<a href="https://redirect.github.com/apache/maven-surefire/pull/774">#774</a>) <a href="https://github.com/michael-o"><code>@​michael-o</code></a></li>
</ul>
<h2>📦 Dependency updates</h2>
<ul>
<li><a href="https://issues.apache.org/jira/browse/SUREFIRE-2273">[SUREFIRE-2273]</a> - Bump org.hamcrest:hamcrest from 2.2 to 3.0 (<a href="https://redirect.github.com/apache/maven-surefire/pull/784">#784</a>) <a href="https://github.com/dependabot"><code>@​dependabot</code></a></li>
<li><a href="https://issues.apache.org/jira/browse/SUREFIRE-2272">[SUREFIRE-2272]</a> - Bump org.codehaus.plexus:plexus-java from 1.2.0 to 1.3.0 - JDK 23 support (<a href="https://redirect.github.com/apache/maven-surefire/pull/786">#786</a>) <a href="https://github.com/dependabot"><code>@​dependabot</code></a></li>
<li><a href="https://issues.apache.org/jira/browse/SUREFIRE-2226">[SUREFIRE-2226]</a> - Upgrade to Maven Verifier 2.0.0-M1 (<a href="https://redirect.github.com/apache/maven-surefire/pull/706">#706</a>) <a href="https://github.com/michael-o"><code>@​michael-o</code></a></li>
<li><a href="https://issues.apache.org/jira/browse/SUREFIRE-2265">[SUREFIRE-2265]</a> - Bump commons-io:commons-io from 2.16.1 to 2.17.0 (<a href="https://redirect.github.com/apache/maven-surefire/pull/779">#779</a>) <a href="https://github.com/dependabot"><code>@​dependabot</code></a></li>
<li><a href="https://issues.apache.org/jira/browse/SUREFIRE-2263">[SUREFIRE-2263]</a> - Use the latest version of surefire for self build (<a href="https://redirect.github.com/apache/maven-surefire/pull/776">#776</a>) <a href="https://github.com/slawekjaranowski"><code>@​slawekjaranowski</code></a></li>
<li><a href="https://issues.apache.org/jira/browse/SUREFIRE-2262">[SUREFIRE-2262]</a> - Bump org.apache.commons:commons-lang3 from 3.16.0 to 3.17.0 (<a href="https://redirect.github.com/apache/maven-surefire/pull/775">#775</a>) <a href="https://github.com/dependabot"><code>@​dependabot</code></a></li>
</ul>
<h2>👻 Maintenance</h2>
<ul>
<li><a href="https://issues.apache.org/jira/browse/SUREFIRE-2269">[SUREFIRE-2269]</a> - Allow fail during clean in surefire-its (<a href="https://redirect.github.com/apache/maven-surefire/pull/785">#785</a>) <a href="https://github.com/slawekjaranowski"><code>@​slawekjaranowski</code></a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/apache/maven-surefire/commit/ea9f049756acf7a3be5234061624c02bd725c9d3"><code>ea9f049</code></a> [maven-release-plugin] prepare release surefire-3.5.2</li>
<li><a href="https://github.com/apache/maven-surefire/commit/e1f94a0281f0db1f9169e06b7ad149a27afd3c46"><code>e1f94a0</code></a> [SUREFIRE-2276] JUnit5's TestTemplate failures treated as flakes with retries</li>
<li><a href="https://github.com/apache/maven-surefire/commit/d24adb4cd702253fa3bf1799e6f067c61d78d75f"><code>d24adb4</code></a> [SUREFIRE-2277] RunResult#getFlakes() is lost during serialisation/deserialis...</li>
<li><a href="https://github.com/apache/maven-surefire/commit/4385e9498b41df32b9016c60feb51396dcec5e1a"><code>4385e94</code></a> Remove links to non-existing report</li>
<li><a href="https://github.com/apache/maven-surefire/commit/88819715a698a2d85a2297443a1cb030a0a4f039"><code>8881971</code></a> Remove outdated FAQ</li>
<li><a href="https://github.com/apache/maven-surefire/commit/012183448e0af139455af71bcdc9ccae82365d38"><code>0121834</code></a> [SUREFIRE-2283] FAQ site contains broken link to failsafe-plugin</li>
<li><a href="https://github.com/apache/maven-surefire/commit/91d16c36f1c90226df4b891f81184140cf805c3c"><code>91d16c3</code></a> Fix formatting of XML schema files</li>
<li><a href="https://github.com/apache/maven-surefire/commit/6cb417a41402be2f6150a6137598cc97c2dd8ad6"><code>6cb417a</code></a> Add .xsd to .gitattributes</li>
<li><a href="https://github.com/apache/maven-surefire/commit/9ce5221100aa3fce8643abcdc2a35bc0c59050ef"><code>9ce5221</code></a> [SUREFIRE-2282] surefire-report-plugin: Update Introduction documentation page</li>
<li><a href="https://github.com/apache/maven-surefire/commit/620b983ffdaa9e258c6a355a476777cfe6b88c0d"><code>620b983</code></a> [SUREFIRE-2281] Upgrade to Doxia 2.0.0 GA Stack</li>
<li>Additional commits viewable in <a href="https://github.com/apache/maven-surefire/compare/surefire-3.5.0...surefire-3.5.2">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=org.apache.maven.plugins:maven-surefire-plugin&package-manager=maven&previous-version=3.5.0&new-version=3.5.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>


Patch:
diff --git a/.gitignore b/.gitignore
index b22249a2..a7ff73a6 100644
--- a/.gitignore
+++ b/.gitignore
@@ -9,3 +9,4 @@ target/
 *Thrash*
 bin/
 .vscode/
+.java-version
diff --git a/CHANGES.md b/CHANGES.md
index 39b789d9..73d01e17 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -29,8 +29,10 @@
   children. [2187](https://github.com/jhy/jsoup/issues/2187)
 * A selector query that included multiple `:has()` components in a nested `:has()` might incorrectly
   execute. [2131](https://github.com/jhy/jsoup/issues/2131)
-* Updated the simple view of cookies available via `Connection.Response#cookies()` to reflect the contents of the 
-  current cookie jar for the current URL. [1831](https://github.com/jhy/jsoup/issues/1831)
+* When cookie names in a response are duplicated, the simple view of cookies available via
+  `Connection.Response#cookies()` will provide the last one set. Generally it is better to use
+  the [Jsoup.newSession](https://jsoup.org/cookbook/web/request-session) method to maintain a cookie jar, as that
+  applies appropriate path selection on cookies when making requests. [1831](https://github.com/jhy/jsoup/issues/1831)
 
 ## 1.18.1 (2024-Jul-10)
 
diff --git a/pom.xml b/pom.xml
index 201f441b..8d837baf 100644
--- a/pom.xml
+++ b/pom.xml
@@ -118,7 +118,7 @@
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-javadoc-plugin</artifactId>
-        <version>3.10.0</version>
+        <version>3.11.1</version>
         <configuration>
           <doclint>none</doclint>
           <source>8</source>
@@ -203,7 +203,7 @@
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-surefire-plugin</artifactId>
-        <version>3.5.0</version>
+        <version>3.5.2</version>
         <configuration>
           <!-- smaller stack to find stack overflows. Was 256, but Zulu on MacOS ARM needs >= 640 -->
           <argLine>-Xss640k</argLine>
@@ -211,7 +211,7 @@
       </plugin>
       <plugin>
         <artifactId>maven-failsafe-plugin</artifactId>
-        <version>3.5.0</version>
+        <version>3.5.2</version>
         <executions>
           <execution>
             <goals>
@@ -372,7 +372,7 @@
         <plugins>
           <plugin>
             <artifactId>maven-failsafe-plugin</artifactId>
-            <version>3.5.0</version>
+            <version>3.5.2</version>
             <executions>
               <execution>
                 <goals>
diff --git a/src/main/java/org/jsoup/Connection.java b/src/main/java/org/jsoup/Connection.java
index 55a5dbac..8ced43f0 100644
--- a/src/main/java/org/jsoup/Connection.java
+++ b/src/main/java/org/jsoup/Connection.java
@@ -632,9 +632,12 @@ public interface Connection {
         T removeCookie(String name);
 
         /**
-         * Retrieve all of the request/response cookies as a map
-         * @return cookies
-         * @see #cookieStore()
+         Retrieve the request/response cookies as a map. For response cookies, if duplicate cookie names were sent, the
+         last one set will be the one included. For session management, rather than using these response cookies, prefer
+         to use {@link Jsoup#newSession()} and related methods.
+
+         @return simple cookie map
+         @see #cookieStore()
          */
         Map<String, String> cookies();
     }
diff --git a/src/main/java/org/jsoup/helper/CookieUtil.java b/src/main/java/org/jsoup/helper/CookieUtil.java
index 218e935e..5ef9c468 100644
--- a/src/main/java/org/jsoup/helper/CookieUtil.java
+++ b/src/main/java/org/jsoup/helper/CookieUtil.java
@@ -2,6 +2,7 @@ package org.jsoup.helper;
 
 import org.jsoup.Connection;
 import org.jsoup.internal.StringUtil;
+import org.jsoup.parser.TokenQueue;
 
 import java.io.IOException;
 import java.net.CookieManager;
@@ -91,13 +92,21 @@ class CookieUtil {
         URI uri = CookieUtil.asUri(url);
         manager.put(uri, resHeaders); // stores cookies for session
 
-        // set up the simple cookie(name, value) map:
-        Map<String, List<String>> cookieMap = manager.get(uri, resHeaders); // get cookies for url; may have been set on this or earlier requests. the headers here are ignored other than a null check
-        for (List<String> values : cookieMap.values()) {
-            for (String headerVal : values) {
-                List<HttpCookie> cookies = HttpCookie.parse(headerVal);
-                for (HttpCookie cookie : cookies) {
-                    res.cookie(cookie.getName(), cookie.getValue());
+        // set up the simple cookies() map
+        // the response may include cookies that are not relevant to this request, but users may require them if they are not using the cookie manager (setting request cookies only from the simple cookies() response):
+        for (Map.Entry<String, List<String>> entry : resHeaders.entrySet()) {
+            String name = entry.getKey();
+            List<String> values = entry.getValue();
+            if (name.equalsIgnoreCase("Set-Cookie")) {
+                for (String value : values) {
+                    if (value == null)
+                        continue;
+                    TokenQueue cd = new TokenQueue(value);
+                    String cookieName = cd.chompTo("=").trim();
+                    String cookieVal = cd.consumeTo(";").trim();
+                    // ignores path, date, domain, validateTLSCertificates et al. full details will be available in cookiestore if required
+                    // name not blank, value not null
+                    res.cookie(cookieName, cookieVal); // if duplicate names, last set will win
                 }
             }
         }
diff --git a/src/main/java/org/jsoup/helper/HttpConnection.java b/src/main/java/org/jsoup/helper/HttpConnection.java
index 71201910..a33bcd91 100644
--- a/src/main/java/org/jsoup/helper/HttpConnection.java
+++ b/src/main/java/org/jsoup/helper/HttpConnection.java
@@ -1136,6 +1136,11 @@ public class HttpConnection implements Connection {
             CookieUtil.storeCookies(req, this, url, resHeaders); // add set cookies to cookie store
 
             if (previousResponse != null) { // was redirected
+                // map previous response cookies into this response cookies() object
+                for (Map.Entry<String, String> prevCookie : previousResponse.cookies().entrySet()) {
+                    if (!hasCookie(prevCookie.getKey()))
+                        cookie(prevCookie.getKey(), prevCookie.getValue());
+                }
                 previousResponse.safeClose();
 
                 // enforce too many redirects:


Test patch:
diff --git a/src/test/java/org/jsoup/integration/ConnectTest.java b/src/test/java/org/jsoup/integration/ConnectTest.java
index 6042f81c..8929dcac 100644
--- a/src/test/java/org/jsoup/integration/ConnectTest.java
+++ b/src/test/java/org/jsoup/integration/ConnectTest.java
@@ -1026,4 +1026,3 @@ public class ConnectTest {
         assertEquals(LargeDocTextLen, document.text().length());
     }
 }
-
diff --git a/src/test/java/org/jsoup/integration/SessionTest.java b/src/test/java/org/jsoup/integration/SessionTest.java
index 89264050..4ae5c5e6 100644
--- a/src/test/java/org/jsoup/integration/SessionTest.java
+++ b/src/test/java/org/jsoup/integration/SessionTest.java
@@ -48,9 +48,12 @@ public class SessionTest {
         Connection con2 = session.newRequest().data(CookieServlet.SetCookiesParam, "1");
         Document doc2 = con2.get();
         assertEquals(0, doc2.select("table tr").size());  // none sent to servlet - we just got them!
-        Map<String, String> cookies = con2.response().cookies(); // simple cookie response, all named "One", so should be first sent
-        assertEquals(1, cookies.size());
-        assertEquals("Root", cookies.get("One"));
+        Map<String, String> cookies = con2.response().cookies(); // simple cookie response, all named "One", so should be last sent
+        assertEquals(2, cookies.size());
+        assertEquals("EchoServlet", cookies.get("One"));
+
+        // test that all response cookies are present, even if would not be sent for this request path (i.e. cookies() res can be set on a req, without using sessions)
+        assertEquals("Override", cookies.get("Two"));
 
         // todo - interrogate cookie-store
 
diff --git a/src/test/java/org/jsoup/integration/servlets/CookieServlet.java b/src/test/java/org/jsoup/integration/servlets/CookieServlet.java
index ef5955f5..ccddee72 100644
--- a/src/test/java/org/jsoup/integration/servlets/CookieServlet.java
+++ b/src/test/java/org/jsoup/integration/servlets/CookieServlet.java
@@ -61,6 +61,14 @@ public class CookieServlet extends BaseServlet {
         Cookie three = new Cookie("One", "EchoServlet");
         three.setPath("/EchoServlet");
         res.addCookie(three);
+
+        Cookie four = new Cookie("Two", "NoSuchPath");
+        four.setPath("/bogus");
+        res.addCookie(four);
+
+        Cookie five = new Cookie("Two", "Override");
+        five.setPath("/bogus");
+        res.addCookie(five);
     }
 
 }