Skip invalid cookies

Previously, an invalid cookie would return an empty array.
amphp · Dec 29, 2023 · a9bfd3a · a9bfd3a
1 parent 9f3500b
commit a9bfd3a
Show file tree

Hide file tree

Showing 3 changed files with 23 additions and 18 deletions.
diff --git a/src/Cookie/RequestCookie.php b/src/Cookie/RequestCookie.php
@@ -12,6 +12,9 @@
  */
 final class RequestCookie implements \Stringable
 {
+ private const NAME_REGEX = /** @lang RegExp */ '(^[^()<>@,;:\\\"/[\]?={}\x01-\x20\x7F]*+$)';
+ private const VALUE_REGEX = /** @lang RegExp */ '(^[\x21\x23-\x2B\x2D-\x3A\x3C-\x5B\x5D-\x7E]*+$)';
+
  /**
  * Parses the cookies from a 'cookie' header.
  *
@@ -26,8 +29,8 @@ public static function fromHeader(string $string): array
  $cookies = \explode(";", $string);
  $result = [];
 
- try {
- foreach ($cookies as $cookie) {
+ foreach ($cookies as $cookie) {
+ try {
  // Ignore zero-length cookie.
  if (\trim($cookie) === '') {
  continue;
@@ -36,21 +39,21 @@ public static function fromHeader(string $string): array
  $parts = \explode('=', $cookie, 2);
 
  if (\count($parts) !== 2) {
- return [];
+ continue;
  }
 
  [$name, $value] = $parts;
 
  $name = \trim($name);
  if ($name === '') {
- return [];
+ continue;
  }
 
  // We can safely trim quotes, as they're not allowed within cookie values
  $result[] = new self($name, \trim($value, " \t\""));
+ } catch (InvalidCookieException) {
+ // Skip invalid cookie.
  }
- } catch (InvalidCookieException) {
- return [];
  }
 
  return $result;
@@ -64,11 +67,11 @@ public static function fromHeader(string $string): array
  */
  public function __construct(private string $name, private string $value = '')
  {
- if (!\preg_match('(^[^()<>@,;:\\\"/[\]?={}\x01-\x20\x7F]*+$)', $name)) {
+ if (!\preg_match(self::NAME_REGEX, $name)) {
  throw new InvalidCookieException("Invalid cookie name: '{$name}'");
  }
 
- if (!\preg_match('(^[\x21\x23-\x2B\x2D-\x3A\x3C-\x5B\x5D-\x7E]*+$)', $value)) {
+ if (!\preg_match(self::VALUE_REGEX, $value)) {
  throw new InvalidCookieException("Invalid cookie value: '{$value}'");
  }
  }
@@ -86,7 +89,7 @@ public function getName(): string
  */
  public function withName(string $name): self
  {
- if (!\preg_match('(^[^()<>@,;:\\\"/[\]?={}\x01-\x20\x7F]++$)', $name)) {
+ if (!\preg_match(self::NAME_REGEX, $name)) {
  throw new InvalidCookieException("Invalid cookie name: '{$name}'");
  }
 
@@ -106,7 +109,7 @@ public function getValue(): string
 
  public function withValue(string $value): self
  {
- if (!\preg_match('(^[\x21\x23-\x2B\x2D-\x3A\x3C-\x5B\x5D-\x7E]*+$)', $value)) {
+ if (!\preg_match(self::VALUE_REGEX, $value)) {
  throw new InvalidCookieException("Invalid cookie value: '{$value}'");
  }
 

diff --git a/src/Cookie/ResponseCookie.php b/src/Cookie/ResponseCookie.php
@@ -12,6 +12,9 @@
  */
 final class ResponseCookie implements \Stringable
 {
+ private const NAME_REGEX = /** @lang RegExp */ '(^[^()<>@,;:\\\"/[\]?={}\x01-\x20\x7F]*+$)';
+ private const VALUE_REGEX = /** @lang RegExp */ '(^[\x21\x23-\x2B\x2D-\x3A\x3C-\x5B\x5D-\x7E]*+$)';
+
  private static array $dateFormats = [
  'D, d M Y H:i:s T',
  'D, d-M-y H:i:s T',
@@ -164,11 +167,11 @@ public function __construct(
  private string $value = '',
  CookieAttributes $attributes = null,
  ) {
- if (!\preg_match('(^[^()<>@,;:\\\"/[\]?={}\x01-\x20\x7F]++$)', $name)) {
+ if (!\preg_match(self::NAME_REGEX, $name)) {
  throw new InvalidCookieException("Invalid cookie name: '{$name}'");
  }
 
- if (!\preg_match('(^[\x21\x23-\x2B\x2D-\x3A\x3C-\x5B\x5D-\x7E]*+$)', $value)) {
+ if (!\preg_match(self::VALUE_REGEX, $value)) {
  throw new InvalidCookieException("Invalid cookie value: '{$value}'");
  }
 
@@ -188,7 +191,7 @@ public function getName(): string
  */
  public function withName(string $name): self
  {
- if (!\preg_match('(^[^()<>@,;:\\\"/[\]?={}\x01-\x20\x7F]++$)', $name)) {
+ if (!\preg_match(self::NAME_REGEX, $name)) {
  throw new InvalidCookieException("Invalid cookie name: '{$name}'");
  }
 
@@ -208,7 +211,7 @@ public function getValue(): string
 
  public function withValue(string $value): self
  {
- if (!\preg_match('(^[\x21\x23-\x2B\x2D-\x3A\x3C-\x5B\x5D-\x7E]*+$)', $value)) {
+ if (!\preg_match(self::VALUE_REGEX, $value)) {
  throw new InvalidCookieException("Invalid cookie value: '{$value}'");
  }
 

diff --git a/test/Cookie/RequestCookieTest.php b/test/Cookie/RequestCookieTest.php
@@ -14,10 +14,9 @@ public function testParsing()
  $this->assertEquals([new RequestCookie("a", "1"), new RequestCookie("b", "2")], RequestCookie::fromHeader("a=1; b=2"));
  $this->assertEquals([new RequestCookie("a", "1"), new RequestCookie("b", "2")], RequestCookie::fromHeader("a=1 ;b=2"));
  $this->assertEquals([new RequestCookie("a", "1"), new RequestCookie("b", "-2")], RequestCookie::fromHeader("a=1; b = -2"));
- $this->assertSame([], RequestCookie::fromHeader("a=1; b=2 2"));
-
- // Any missing = MUST discard the full cookie header
- $this->assertSame([], RequestCookie::fromHeader("a=1; b"));
+ $this->assertEquals([new RequestCookie("a", "1")], RequestCookie::fromHeader("a=1; b=2,2"));
+ $this->assertEquals([new RequestCookie("a", "1")], RequestCookie::fromHeader("a=1; b=2 2"));
+ $this->assertEquals([new RequestCookie("a", "1")], RequestCookie::fromHeader("a=1; b"));
  }
 
  /**