[HttpFoundation] allow additinal characters in not raw cookies

marie · nicolas-grekas · commit 35ffbbfa73e4 · 2019-09-28T17:09:56.000+02:00
diff --git a/Cookie.php b/Cookie.php
@@ -18,19 +18,24 @@
  */
 class Cookie
 {
+    const SAMESITE_NONE = 'none';
+    const SAMESITE_LAX = 'lax';
+    const SAMESITE_STRICT = 'strict';
+
     protected $name;
     protected $value;
     protected $domain;
     protected $expire;
     protected $path;
     protected $secure;
     protected $httpOnly;
+
     private $raw;
     private $sameSite;
 
-    const SAMESITE_NONE = 'none';
-    const SAMESITE_LAX = 'lax';
-    const SAMESITE_STRICT = 'strict';
+    private static $reservedCharsList = "=,; \t\r\n\v\f";
+    private static $reservedCharsFrom = ['=', ',', ';', ' ', "\t", "\r", "\n", "\v", "\f"];
+    private static $reservedCharsTo = ['%3D', '%2C', '%3B', '%20', '%09', '%0D', '%0A', '%0B', '%0C'];
 
     /**
      * Creates cookie from raw header string.
@@ -97,7 +102,7 @@ public static function fromString($cookie, $decode = false)
     public function __construct($name, $value = null, $expire = 0, $path = '/', $domain = null, $secure = false, $httpOnly = true, $raw = false, $sameSite = null)
     {
         // from PHP source code
-        if (preg_match("/[=,; \t\r\n\013\014]/", $name)) {
+        if ($raw && false !== strpbrk($name, self::$reservedCharsList)) {
             throw new \InvalidArgumentException(sprintf('The cookie name "%s" contains invalid characters.', $name));
         }
 
@@ -143,7 +148,13 @@ public function __construct($name, $value = null, $expire = 0, $path = '/', $dom
      */
     public function __toString()
     {
-        $str = ($this->isRaw() ? $this->getName() : urlencode($this->getName())).'=';
+        if ($this->isRaw()) {
+            $str = $this->getName();
+        } else {
+            $str = str_replace(self::$reservedCharsFrom, self::$reservedCharsTo, $this->getName());
+        }
+
+        $str .= '=';
 
         if ('' === (string) $this->getValue()) {
             $str .= 'deleted; expires='.gmdate('D, d-M-Y H:i:s T', time() - 31536001).'; Max-Age=0';
diff --git a/Response.php b/Response.php
@@ -342,7 +342,7 @@ public function sendHeaders()
 
         // cookies
         foreach ($this->headers->getCookies() as $cookie) {
-            header('Set-Cookie: '.$cookie->getName().strstr($cookie, '='), false, $this->statusCode);
+            header('Set-Cookie: '.$cookie, false, $this->statusCode);
         }
 
         // status
diff --git a/Tests/CookieTest.php b/Tests/CookieTest.php
@@ -24,10 +24,9 @@
  */
 class CookieTest extends TestCase
 {
-    public function invalidNames()
+    public function namesWithSpecialCharacters()
     {
         return [
-            [''],
             [',MyName'],
             [';MyName'],
             [' MyName'],
@@ -40,12 +39,26 @@ public function invalidNames()
     }
 
     /**
-     * @dataProvider invalidNames
+     * @dataProvider namesWithSpecialCharacters
      */
-    public function testInstantiationThrowsExceptionIfCookieNameContainsInvalidCharacters($name)
+    public function testInstantiationThrowsExceptionIfRawCookieNameContainsSpecialCharacters($name)
     {
         $this->expectException('InvalidArgumentException');
-        new Cookie($name);
+        new Cookie($name, null, 0, null, null, null, false, true);
+    }
+
+    /**
+     * @dataProvider namesWithSpecialCharacters
+     */
+    public function testInstantiationSucceedNonRawCookieNameContainsSpecialCharacters($name)
+    {
+        $this->assertInstanceOf(Cookie::class, new Cookie($name));
+    }
+
+    public function testInstantiationThrowsExceptionIfCookieNameIsEmpty()
+    {
+        $this->expectException('InvalidArgumentException');
+        new Cookie('');
     }
 
     public function testInvalidExpiration()
diff --git a/Tests/Fixtures/response-functional/cookie_urlencode.expected b/Tests/Fixtures/response-functional/cookie_urlencode.expected
@@ -4,7 +4,8 @@ Array
     [0] => Content-Type: text/plain; charset=utf-8
     [1] => Cache-Control: no-cache, private
     [2] => Date: Sat, 12 Nov 1955 20:04:00 GMT
-    [3] => Set-Cookie: ?*():@&+$/%#[]=%3F%2A%28%29%3A%40%26%2B%24%2F%25%23%5B%5D; path=/
+    [3] => Set-Cookie: %3D%2C%3B%20%09%0D%0A%0B%0C=%3D%2C%3B%20%09%0D%0A%0B%0C; path=/
     [4] => Set-Cookie: ?*():@&+$/%#[]=%3F%2A%28%29%3A%40%26%2B%24%2F%25%23%5B%5D; path=/
+    [5] => Set-Cookie: ?*():@&+$/%#[]=%3F%2A%28%29%3A%40%26%2B%24%2F%25%23%5B%5D; path=/
 )
 shutdown
diff --git a/Tests/Fixtures/response-functional/cookie_urlencode.php b/Tests/Fixtures/response-functional/cookie_urlencode.php
@@ -4,9 +4,12 @@
 
 $r = require __DIR__.'/common.inc';
 
-$str = '?*():@&+$/%#[]';
+$str1 = "=,; \t\r\n\v\f";
+$r->headers->setCookie(new Cookie($str1, $str1, 0, '', null, false, false, false, null));
 
-$r->headers->setCookie(new Cookie($str, $str, 0, '', null, false, false));
+$str2 = '?*():@&+$/%#[]';
+
+$r->headers->setCookie(new Cookie($str2, $str2, 0, '', null, false, false, false, null));
 $r->sendHeaders();
 
-setcookie($str, $str, 0, '/');
+setcookie($str2, $str2, 0, '/');
diff --git a/Tests/Fixtures/response-functional/invalid_cookie_name.php b/Tests/Fixtures/response-functional/invalid_cookie_name.php
@@ -5,7 +5,7 @@
 $r = require __DIR__.'/common.inc';
 
 try {
-    $r->headers->setCookie(new Cookie('Hello + world', 'hodor'));
+    $r->headers->setCookie(new Cookie('Hello + world', 'hodor', 0, null, null, null, false, true));
 } catch (\InvalidArgumentException $e) {
     echo $e->getMessage();
 }

Original file line number	Diff line number	Diff line change
`@@ -342,7 +342,7 @@ public function sendHeaders()`
`342`	`342`
`343`	`343`	`// cookies`
`344`	`344`	`foreach ($this->headers->getCookies() as $cookie) {`
`345`		`- header('Set-Cookie: '.$cookie->getName().strstr($cookie, '='), false, $this->statusCode);`
	`345`	`+ header('Set-Cookie: '.$cookie, false, $this->statusCode);`
`346`	`346`	`}`
`347`	`347`
`348`	`348`	`// status`
Original file line number	Diff line number	Diff line change
`@@ -5,7 +5,7 @@`
`5`	`5`	`$r = require __DIR__.'/common.inc';`
`6`	`6`
`7`	`7`	`try {`
`8`		`- $r->headers->setCookie(new Cookie('Hello + world', 'hodor'));`
	`8`	`+ $r->headers->setCookie(new Cookie('Hello + world', 'hodor', 0, null, null, null, false, true));`
`9`	`9`	`} catch (\InvalidArgumentException $e) {`
`10`	`10`	`echo $e->getMessage();`
`11`	`11`	`}`