Disallow invalid characters in session.name

[ostrolucky]

Q	A
Branch?	2.7
Bug fix?	yes
New feature?	no
BC breaks?	no
Deprecations?	no
Tests pass?	yes
Fixed tickets	#27023
License	MIT
Doc PR

PHP saves cookie with correct name, but upon deserialization to
$_COOKIE, it replaces "." characters with "_".

This is probably also reason why \SessionHandler is not able to find
a session.

https://harrybailey.com/2009/04/dots-arent-allowed-in-php-cookie-names/
https://bugs.php.net/bug.php?id=75883

[nicolas-grekas]

Good idea.
I'd suggest to be bullet proof using parse_str for normalization:
php > parse_str('a.b', $a);
php > print_r($a);
Array
(
[a_b] =>
)

[ostrolucky]

Not sure what do you mean. Can you be more specific? Should I change this validation approach to just normalization approach? Frankly, I would like that more, so I don't have to do that by myself in userspace.

Some cases are also handled internally by php's setcookie

ErrorException:
Warning: Cookie names cannot contain any of the following '=,; \t\r\n\013\014'

  at vendor\symfony\http-foundation\Session\Storage\Handler\AbstractSessionHandler.php:148

[nicolas-grekas]

Instead of checking for some chars (there are more that are turned to an underscore), I was thinking about doing the check like this:
parse_str($name, $parsedName);
if (array($name => '') !== $parsedName) => the name is invalid

[nicolas-grekas]

missing double quotes around %s
about the implode, this means & is valid in a session name? how strange is that :)
but OK, that's because cookie are not encoded using URL queries.
This also means we should exclude ;, isn't it?

[ostrolucky]

Config quotes it by type itself, if I did it, it would be double quoted. Yes, & is valid. No need to exclude ; and further complicate this closure, rest of the chars are handled by setcookie call. As long as developer is warned, it's all good.

Got any pointers why appveyor fails?

[ostrolucky]

Appveryor fails for some reason on ' char even though it's valid... I've just removed it from test case

[fabpot]

Thank you @ostrolucky.