golang.org/x/net v0.12.0: publicsuffix.List

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify golang.org/x/net/publicsuffix.List in pkg:golang/golang.org/x/net@v0.12.0
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/golang.org/x/net@v0.12.0
Demonstrate these symbols/APIs:
  - golang.org/x/net/publicsuffix.List

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:3c0beb05cd18eeb194b81aa5a37776a5f6b4223ff6ec2091568310596666ad58","contract":["publicsuffix.List implements the net/http/cookiejar PublicSuffixList interface","publicsuffix.List.PublicSuffix extracts public suffixes for standard gTLDs and ccTLDs","publicsuffix.List.PublicSuffix recognizes private managed domains as public suffixes","publicsuffix.List.PublicSuffix returns the domain unchanged when it is already a public suffix","publicsuffix.List.PublicSuffix falls back to the rightmost label for unlisted suffixes","publicsuffix.List.String returns the public suffix list provenance description","publicsuffix.List configures cookiejar to accept domain-scoped cookies while blocking public-suffix supercookies"],"goal":"verify golang.org/x/net/publicsuffix.List in pkg:golang/golang.org/x/net@v0.12.0","kind":"HOW","packages":["pkg:golang/golang.org/x/net@v0.12.0"],"schemaVersion":1,"symbols":["golang.org/x/net/publicsuffix.List"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/golang.org/x/net@v0.12.0"],"schemaVersion":1,"subject":"pkg:golang/golang.org/x/net@v0.12.0","symbols":["golang.org/x/net/publicsuffix.List"],"verifierAdapter":"golang@1"}

module example.com/sample

go 1.26.6

require golang.org/x/net v0.12.0

golang.org/x/net v0.12.0 h1:cfawfvKITfUsFCeJIHJrbSxpeu/E81khclypR0GVT50=
golang.org/x/net v0.12.0/go.mod h1:zEVYFnQC7m/vmpQFELhcD1EWkZlX69l4oqgmer6hfKA=

package main

import (
	"fmt"
	"log"
	"net/http"
	"net/http/cookiejar"
	"net/url"

	"golang.org/x/net/publicsuffix"
)

func main() {
	// Initialize cookie jar with publicsuffix.List
	jar, err := cookiejar.New(&cookiejar.Options{PublicSuffixList: publicsuffix.List})
	if err != nil {
		log.Fatalf("failed to create cookiejar: %v", err)
	}

	// 1. Query public suffix for domain
	domain := "sub.example.com"
	suffix := publicsuffix.List.PublicSuffix(domain)
	fmt.Printf("Domain: %s -> Public Suffix: %s\n", domain, suffix)

	// 2. Query list provenance description
	desc := publicsuffix.List.String()
	fmt.Printf("List description: %s\n", desc)

	// 3. Enforce cookie scoping rules with publicsuffix.List
	targetURL, err := url.Parse("http://sub.example.com/")
	if err != nil {
		log.Fatalf("failed to parse url: %v", err)
	}

	// Scoped to eTLD+1 (example.com): accepted
	jar.SetCookies(targetURL, []*http.Cookie{
		{Name: "session", Value: "active", Domain: "example.com", Path: "/"},
	})
	fmt.Printf("Cookies stored for valid domain: %d\n", len(jar.Cookies(targetURL)))

	// Scoped to public suffix (com): rejected
	jar.SetCookies(targetURL, []*http.Cookie{
		{Name: "supercookie", Value: "blocked", Domain: "com", Path: "/"},
	})
	fmt.Printf("Cookies stored after public suffix cookie: %d\n", len(jar.Cookies(targetURL)))
}

{
  "schemaVersion": 1,
  "goal": "verify golang.org/x/net/publicsuffix.List in pkg:golang/golang.org/x/net@v0.12.0",
  "kind": "HOW",
  "packages": [
    "pkg:golang/golang.org/x/net@v0.12.0"
  ],
  "symbols": [
    "golang.org/x/net/publicsuffix.List"
  ]
}

package main

import (
	"fmt"
	"net/http"
	"net/http/cookiejar"
	"net/url"
	"os"
	"strings"

	"golang.org/x/net/publicsuffix"
)

func main() {
	// 1. publicsuffix.List implements the net/http/cookiejar PublicSuffixList interface
	{
		var psl cookiejar.PublicSuffixList = publicsuffix.List
		if psl == nil {
			fmt.Fprintf(os.Stderr, "assertion 1 failed: publicsuffix.List does not satisfy cookiejar.PublicSuffixList\n")
			os.Exit(1)
		}
	}

	// 2. publicsuffix.List.PublicSuffix extracts public suffixes for standard gTLDs and ccTLDs
	{
		testCases := []struct {
			domain     string
			wantSuffix string
		}{
			{"example.com", "com"},
			{"sub.example.com", "com"},
			{"api.service.org", "org"},
			{"foo.bar.co.uk", "co.uk"},
			{"city.tokyo.jp", "tokyo.jp"},
		}

		for _, tc := range testCases {
			got := publicsuffix.List.PublicSuffix(tc.domain)
			if got != tc.wantSuffix {
				fmt.Fprintf(os.Stderr, "assertion 2 failed for %q: got %q, want %q\n", tc.domain, got, tc.wantSuffix)
				os.Exit(1)
			}
		}
	}

	// 3. publicsuffix.List.PublicSuffix recognizes private managed domains as public suffixes
	{
		testCases := []struct {
			domain     string
			wantSuffix string
		}{
			{"user.github.io", "github.io"},
			{"bucket.s3.amazonaws.com", "s3.amazonaws.com"},
		}

		for _, tc := range testCases {
			got := publicsuffix.List.PublicSuffix(tc.domain)
			if got != tc.wantSuffix {
				fmt.Fprintf(os.Stderr, "assertion 3 failed for %q: got %q, want %q\n", tc.domain, got, tc.wantSuffix)
				os.Exit(1)
			}
		}
	}

	// 4. publicsuffix.List.PublicSuffix returns the domain unchanged when it is already a public suffix
	{
		testCases := []string{
			"com",
			"org",
			"co.uk",
			"github.io",
		}

		for _, dom := range testCases {
			got := publicsuffix.List.PublicSuffix(dom)
			if got != dom {
				fmt.Fprintf(os.Stderr, "assertion 4 failed for %q: got %q, want %q\n", dom, got, dom)
				os.Exit(1)
			}
		}
	}

	// 5. publicsuffix.List.PublicSuffix falls back to the rightmost label for unlisted suffixes
	{
		got := publicsuffix.List.PublicSuffix("host.unlistedcustomtld")
		if got != "unlistedcustomtld" {
			fmt.Fprintf(os.Stderr, "assertion 5 failed: got %q, want %q\n", got, "unlistedcustomtld")
			os.Exit(1)
		}
	}

	// 6. publicsuffix.List.String returns the public suffix list provenance description
	{
		desc := publicsuffix.List.String()
		if desc == "" || !strings.Contains(desc, "publicsuffix.org") {
			fmt.Fprintf(os.Stderr, "assertion 6 failed: unexpected description %q\n", desc)
			os.Exit(1)
		}
	}

	// 7. publicsuffix.List configures cookiejar to accept domain-scoped cookies while blocking public-suffix supercookies
	{
		jar, err := cookiejar.New(&cookiejar.Options{PublicSuffixList: publicsuffix.List})
		if err != nil {
			fmt.Fprintf(os.Stderr, "assertion 7 failed to create cookiejar: %v\n", err)
			os.Exit(1)
		}

		targetURL, err := url.Parse("http://sub.example.com/")
		if err != nil {
			fmt.Fprintf(os.Stderr, "assertion 7 failed to parse URL: %v\n", err)
			os.Exit(1)
		}

		// Valid cookie scoped to eTLD+1 (example.com)
		jar.SetCookies(targetURL, []*http.Cookie{
			{Name: "session", Value: "valid_session", Domain: "example.com", Path: "/"},
		})
		cookies := jar.Cookies(targetURL)
		if len(cookies) != 1 || cookies[0].Name != "session" {
			fmt.Fprintf(os.Stderr, "assertion 7 failed: expected 1 valid cookie, got %d\n", len(cookies))
			os.Exit(1)
		}

		// Supercookie scoped directly to public suffix (com) must be rejected
		jar.SetCookies(targetURL, []*http.Cookie{
			{Name: "supercookie", Value: "evil_value", Domain: "com", Path: "/"},
		})
		cookiesAfter := jar.Cookies(targetURL)
		if len(cookiesAfter) != 1 {
			fmt.Fprintf(os.Stderr, "assertion 7 failed: supercookie was not rejected, count is %d\n", len(cookiesAfter))
			os.Exit(1)
		}
	}

	fmt.Println("PASS: golang.org/x/net/publicsuffix.List contract verified")
}