[Security] Fix false-string handling in RememberMeAuthenticator

symfony · Jul 7, 2023 · 8d9328e · 8d9328e
1 parent 6791856
commit 8d9328e
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 1 deletion.
diff --git a/Authenticator/RememberMeAuthenticator.php b/Authenticator/RememberMeAuthenticator.php
@@ -70,7 +70,7 @@ public function supports(Request $request): ?bool
             return false;
         }
 
-        if (!$request->cookies->has($this->cookieName)) {
+        if (!$request->cookies->has($this->cookieName) || !\is_scalar($request->cookies->all()[$this->cookieName] ?: null)) {
             return false;
         }
 

diff --git a/Tests/Authenticator/RememberMeAuthenticatorTest.php b/Tests/Authenticator/RememberMeAuthenticatorTest.php
@@ -61,6 +61,9 @@ public static function provideSupportsData()
         $request = Request::create('/', 'GET', [], ['_remember_me_cookie' => 'rememberme']);
         $request->attributes->set(ResponseListener::COOKIE_ATTR_NAME, new Cookie('_remember_me_cookie', null));
         yield [$request, false];
+
+        $request = Request::create('/', 'GET', [], ['_remember_me_cookie' => '0']);
+        yield [$request, false];
     }
 
     public function testAuthenticate()