Skip to content
This repository has been archived by the owner on Jan 30, 2020. It is now read-only.

Fix invalid exception from urlencoded cookie value #23

Merged
merged 3 commits into from
Sep 14, 2015
Merged

Fix invalid exception from urlencoded cookie value #23

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
83bcfc1
Fix invalid exception from urlencoded cookie value
zerocrates Sep 12, 2015
83ec382
Test SetCookie CRLF attack prevention directly
zerocrates Sep 12, 2015
0a3911c
Add CRLF attack test for SetCookie::setValue
zerocrates Sep 12, 2015
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 0 additions & 1 deletion src/Header/SetCookie.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -302,7 +302,6 @@ public function getName()
*/
public function setValue($value)
{
HeaderValue::assertValid($value);
$this->value = $value;
return $this;
}
Expand Down
3 changes: 2 additions & 1 deletion test/Header/SetCookieTest.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@

namespace ZendTest\Http\Header;

use Zend\Http\Header\HeaderValue;
use Zend\Http\Header\SetCookie;

class SetCookieTest extends \PHPUnit_Framework_TestCase
Expand Down Expand Up @@ -431,8 +432,8 @@ public function testPreventsCRLFAttackViaFromString()
*/
public function testPreventsCRLFAttackViaConstructor()
{
$this->setExpectedException('Zend\Http\Header\Exception\InvalidArgumentException');
$header = new SetCookie("leo_auth_token", "example\r\n\r\nevilContent");
$this->assertTrue(HeaderValue::isValid($header->getFieldValue()));
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I preffer if you assertEquals against the __toString() output. Will be more clear to understand because the encoded characters will be visible while reading this code.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could you add an additional test method for unit check of setValue?

}

public function setterInjections()
Expand Down