From 2eaa7ee0fd9d9335e156534b8d062fdfa4134a31 Mon Sep 17 00:00:00 2001 From: Jordi Boggiano Date: Thu, 8 May 2025 11:03:40 +0200 Subject: [PATCH] [Security] Avoid failing when PersistentRememberMeHandler handles a malformed cookie --- .../RememberMe/PersistentRememberMeHandler.php | 7 ++++++- .../PersistentRememberMeHandlerTest.php | 16 ++++++++++++++++ 2 files changed, 22 insertions(+), 1 deletion(-) diff --git a/src/Symfony/Component/Security/Http/RememberMe/PersistentRememberMeHandler.php b/src/Symfony/Component/Security/Http/RememberMe/PersistentRememberMeHandler.php index 2293666ae7ecb..ad1d990fd74ff 100644 --- a/src/Symfony/Component/Security/Http/RememberMe/PersistentRememberMeHandler.php +++ b/src/Symfony/Component/Security/Http/RememberMe/PersistentRememberMeHandler.php @@ -160,7 +160,12 @@ public function clearRememberMeCookie(): void return; } - $rememberMeDetails = RememberMeDetails::fromRawCookie($cookie); + try { + $rememberMeDetails = RememberMeDetails::fromRawCookie($cookie); + } catch (AuthenticationException) { + // malformed cookie should not fail the response and can be simply ignored + return; + } [$series] = explode(':', $rememberMeDetails->getValue()); $this->tokenProvider->deleteTokenBySeries($series); } diff --git a/src/Symfony/Component/Security/Http/Tests/RememberMe/PersistentRememberMeHandlerTest.php b/src/Symfony/Component/Security/Http/Tests/RememberMe/PersistentRememberMeHandlerTest.php index a5bdac65118d8..bd539341c3f6c 100644 --- a/src/Symfony/Component/Security/Http/Tests/RememberMe/PersistentRememberMeHandlerTest.php +++ b/src/Symfony/Component/Security/Http/Tests/RememberMe/PersistentRememberMeHandlerTest.php @@ -74,6 +74,22 @@ public function testClearRememberMeCookie() $this->assertNull($cookie->getValue()); } + public function testClearRememberMeCookieMalformedCookie() + { + $this->tokenProvider->expects($this->exactly(0)) + ->method('deleteTokenBySeries'); + + $this->request->cookies->set('REMEMBERME', 'malformed'); + + $this->handler->clearRememberMeCookie(); + + $this->assertTrue($this->request->attributes->has(ResponseListener::COOKIE_ATTR_NAME)); + + /** @var Cookie $cookie */ + $cookie = $this->request->attributes->get(ResponseListener::COOKIE_ATTR_NAME); + $this->assertNull($cookie->getValue()); + } + public function testConsumeRememberMeCookieValid() { $this->tokenProvider->expects($this->any()) pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.

Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy