CI: reduce parse_nested_ipv4 and parse_cookie_header below CCN 10

The complexity gate (scripts/check-complexity.sh, lizard, CCN_MAX=10) ran
green for the first time once cpplint stopped failing earlier in the lint
lane, exposing two pre-existing over-threshold functions:
  - ip_representation.cpp parse_nested_ipv4 (CCN 11)
  - cookie.cpp parse_cookie_header (CCN 12)

Extract cohesive blocks into commented anonymous-namespace helpers
(validate_ipv4_mapped_prefix, parse_cookie_token), preserving exact
validation/exception behavior. New CCN: 8 and 6. Verified with lizard,
library build, cpplint, and the ip_access_control / cookie_render /
cookie_header_sentinel / http_request_cookies_parsed / http_response_cookie_wire
test binaries (0 failures).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NpysYDDJac63yz2mZKKiDf

Author: etr

src/cookie.cpp

@@ -179,6 +179,44 @@ std::string_view same_site_attribute_text(same_site_mode m) noexcept {
     return {};
 }
 
+// Parse a single `; `-delimited cookie entry into a (name, value) view
+// pair. Returns nullopt for entries that carry no usable cookie: empty
+// after trimming, missing `=`, a leading `=` (empty name), or an empty
+// name after trimming. Strips one pair of outer DQUOTEs from the value
+// and trims ASCII whitespace around the name; byte-transparent
+// otherwise (the wire may deliver bytes the setters would reject).
+// Lifted out of parse_cookie_header to keep that function below the
+// CCN bar.
+std::optional<std::pair<std::string_view, std::string_view>>
+parse_cookie_token(std::string_view tok) {
+    tok = trim_ws(tok);
+    if (tok.empty()) {
+        return std::nullopt;
+    }
+    const std::size_t eq = tok.find('=');
+    if (eq == std::string_view::npos || eq == 0) {
+        return std::nullopt;
+    }
+    std::string_view name_sv = tok.substr(0, eq);
+    std::string_view value_sv = tok.substr(eq + 1);
+
+    // Strip a single pair of outer DQUOTEs from the value (RFC 6265
+    // §5.2 step 2 implementation detail and common browser practice).
+    if (value_sv.size() >= 2
+            && value_sv.front() == '"'
+            && value_sv.back() == '"') {
+        value_sv = value_sv.substr(1, value_sv.size() - 2);
+    }
+
+    // Trim trailing whitespace from the name (rare, but defends
+    // against `a =b`).
+    name_sv = trim_ws(name_sv);
+    if (name_sv.empty()) {
+        return std::nullopt;
+    }
+    return std::make_pair(name_sv, value_sv);
+}
+
 }  // namespace
 
 // ----------------------------------------------------------------------
@@ -385,39 +423,16 @@ std::vector<cookie> cookie::parse_cookie_header(std::string_view header_value) {
         const std::size_t tok_end =
             (end == std::string_view::npos) ? header_value.size() : end;
 
-        std::string_view tok = header_value.substr(pos, tok_end - pos);
-        tok = trim_ws(tok);
-
-        if (!tok.empty()) {
-            const std::size_t eq = tok.find('=');
-            if (eq != std::string_view::npos && eq > 0) {
-                std::string_view name_sv = tok.substr(0, eq);
-                std::string_view value_sv = tok.substr(eq + 1);
-
-                // Strip a single pair of outer DQUOTEs from the value
-                // (RFC 6265 §5.2 step 2 implementation detail and
-                // common browser practice).
-                if (value_sv.size() >= 2
-                        && value_sv.front() == '"'
-                        && value_sv.back() == '"') {
-                    value_sv = value_sv.substr(1, value_sv.size() - 2);
-                }
-
-                // Trim trailing whitespace from the name (rare, but
-                // defends against `a =b`).
-                name_sv = trim_ws(name_sv);
-
-                if (!name_sv.empty()) {
-                    cookie c;
-                    // Bypass validation: parsed input may technically
-                    // contain bytes the validator would reject (e.g. a
-                    // SP inside a quoted value). We accept what the
-                    // wire delivers; the renderer is the strict side.
-                    c.name_ = std::string(name_sv);
-                    c.value_ = std::string(value_sv);
-                    out.push_back(std::move(c));
-                }
-            }
+        auto parsed = parse_cookie_token(header_value.substr(pos, tok_end - pos));
+        if (parsed.has_value()) {
+            cookie c;
+            // Bypass validation: parsed input may technically contain
+            // bytes the validator would reject (e.g. a SP inside a
+            // quoted value). We accept what the wire delivers; the
+            // renderer is the strict side.
+            c.name_ = std::string(parsed->first);
+            c.value_ = std::string(parsed->second);
+            out.push_back(std::move(c));
         }
 
         if (end == std::string_view::npos) {

src/detail/ip_representation.cpp

@@ -128,6 +128,26 @@ bool ipv4_mapped_prefix_invalid(uint16_t a, uint16_t b) {
     return (a != 0 && a != 255) || (b != 0 && b != 255);
 }
 
+// The 12-byte prefix that precedes a nested IPv4 dotted-quad must be
+// all-zero for bytes 0-9, with bytes 10-11 each 0x00 (pure ::-mapped)
+// or 0xFF (v4-mapped). Throws invalid_argument on any other prefix.
+// Lifted out of parse_nested_ipv4 so the surrounding function stays
+// below the CCN bar.
+void validate_ipv4_mapped_prefix(const uint16_t* pieces) {
+    for (unsigned int k = 0; k < 10; k++) {
+        if (pieces[k] != 0) {
+            throw std::invalid_argument(
+                "IP is badly formatted. Nested IPV4 can be preceded only by 0 "
+                "(and, optionally, two 255 octects)");
+        }
+    }
+    if (ipv4_mapped_prefix_invalid(pieces[10], pieces[11])) {
+        throw std::invalid_argument(
+            "IP is badly formatted. Nested IPV4 can be preceded only by 0 "
+            "(and, optionally, two 255 octects)");
+    }
+}
+
 }  // namespace
 
 void ip_representation::parse_ipv4(const std::string& ip) {
@@ -189,18 +209,7 @@ void ip_representation::parse_nested_ipv4(const std::vector<std::string>& parts,
         throw std::invalid_argument("IP is badly formatted. Nested IPV4 can have max 4 parts.");
     }
     // Bytes 0-9 must be zero; bytes 10-11 must be 0x00 or 0xFF.
-    for (unsigned int k = 0; k < 10; k++) {
-        if (pieces[k] != 0) {
-            throw std::invalid_argument(
-                "IP is badly formatted. Nested IPV4 can be preceded only by 0 "
-                "(and, optionally, two 255 octects)");
-        }
-    }
-    if (ipv4_mapped_prefix_invalid(pieces[10], pieces[11])) {
-        throw std::invalid_argument(
-            "IP is badly formatted. Nested IPV4 can be preceded only by 0 "
-            "(and, optionally, two 255 octects)");
-    }
+    validate_ipv4_mapped_prefix(pieces);
     for (unsigned int ii = 0; ii < subparts.size(); ii++) {
         if (subparts[ii] == "*") {
             clear_bit(mask, static_cast<unsigned int>(y + ii));