Skip to content
This repository has been archived by the owner on Jan 30, 2020. It is now read-only.

cookie values decode error #15

Closed
malinink opened this issue Aug 5, 2015 · 4 comments · Fixed by #23
Closed

cookie values decode error #15

malinink opened this issue Aug 5, 2015 · 4 comments · Fixed by #23

Comments

@malinink
Copy link

malinink commented Aug 5, 2015

Hi!
I have found one problem with encoding.

In PHP it's normal behavior that values are urlencoded, but in other languages there are another standards for encoding such value, for example - in python.

So, cookie created in python could be invalid after urldecode here:
https://github.com/zendframework/zend-http/blob/master/src/Header/SetCookie.php#L119

But if we want to fix that issue, we suppose to get rid of that urlencode also:
https://github.com/zendframework/zend-http/blob/master/src/Header/SetCookie.php#L236

That is wrong, cause when we try to set cookie with specific symbols - we get wrong cookie.

I really don't know how to fix problem, have anyone ideas?

I thought that best approach is to add client type (php, python) and add specific decode/encode functions for each type, also add default type which only encode values.

At now I have a site that causes Zend Http Client failed on send method:

        $client = new Client('http://www.gd.ru/articles/3514-uvelichenie-prodaj');
        $client->send();
malinink pushed a commit to malinink/zend-http that referenced this issue Aug 5, 2015
malinink pushed a commit to malinink/zend-http that referenced this issue Aug 5, 2015
@malinink
Copy link
Author

malinink commented Aug 5, 2015

For example default action may looks like that one.

@malinink malinink changed the title session values encode error session values decode error Aug 5, 2015
@malinink malinink changed the title session values decode error cookie values decode error Aug 5, 2015
@weierophinney
Copy link
Member

@malinink Can you please submit your changes as a pull request?

@malinink
Copy link
Author

malinink commented Aug 5, 2015

@weierophinney Pull request have been added.

@zerocrates
Copy link
Contributor

I mistakenly filed a duplicate issue for this.

I think the best way to distill it down is to post a tiny one-liner that fails when it shouldn't:

Zend\Http\Header\SetCookie::fromString('Set-Cookie:foo=%0A; path=/; HttpOnly');

The practical upshot is that any attempt to make a request to a server that responds with SetCookie headers with url-encoded whitespace in the value will fail because the SetCookie header class is urldecoding the value before attempting to validate it.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants