Weird behavior on bad regular expression test in cookies

[buixor]

Having the following test :

$ cat tests/encrypt_regexp_cookies_bad_regexp.phpt 
--TEST--
Cookie decryption in ipv4
--SKIPIF--
<?php if (!extension_loaded("snuffleupagus")) die "skip"; ?>
--INI--
sp.configuration_file={PWD}/config/config_encrypted_regexp_cookies_bad_regexp.ini
--COOKIE--
super_cookie=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP3gV9YJZL/pUeNAjCKFW0U2ywmf1CwHzwd2pWM=;awful_cookie=awful_cookie_value;
--ENV--
return <<<EOF
REMOTE_ADDR=127.0.0.1
HTTP_USER_AGENT=Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/59.0.3071.109 Chrome/59.0.3071.109 Safari/537.36
EOF;
--FILE--
<?php var_dump($_COOKIE); ?>
--EXPECT--
[snuffleupagus][0.0.0.0][config][error] Failed to compile '^super_co[a-z+$': missing terminating ] for character class on line %d.
[snuffleupagus][0.0.0.0][config][error] '.name_r()' is expecting a valid regexp, and not '"^super_co[a-z+$"' on line %d.
array(0) {
}

with the associated .ini (notice the invalid regexp) :

sp.global.secret_key("abcdef").cookie_env_var("REMOTE_ADDR");
sp.cookie.name_r("^super_co[a-z+$").encrypt();
sp.auto_cookie_secure.enable();

Leads to the fail testing with the following .out :

array(2) {
  ["super_cookie"]=>
  string(92) "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP3gV9YJZL/pUeNAjCKFW0U2ywmf1CwHzwd2pWM="
  ["awful_cookie"]=>
  string(18) "awful_cookie_value"
}

While launching by hand gives the expected result :

$ sh tests/encrypt_regexp_cookies_bad_regexp.sh 
[snuffleupagus][0.0.0.0][config][error] Failed to compile '^super_co[a-z+$': missing terminating ] for character class on line 2.
[snuffleupagus][0.0.0.0][config][error] '.name_r()' is expecting a valid regexp, and not '"^super_co[a-z+$"' on line 2.
array(0) {
}

[jvoisin]

Apparently, the configuration file isn't parsed when running under php's testsuite, but it is when run why hand.

[jvoisin]

This is what I've got when calling phpinfo() via the testsuite, and manually via the .sh file.

[jvoisin]

By diffing the phpinfo(), I found some interesting differences:

• The environment variable HTTP_COOKIE is absent from the .sh-generated output
• The sh-generated output has the same env variables than my shell, and all of them are passed via the $_SERVER and $_ENV globals
• The .sh-generated on has variables_order: EGPCS, while the php-testsuite-generated one has variables_order: GPCS

I guess this is why the behaviour can't be reproduced.