Merge pull request #17298 from cakephp/issue-17296

Fix cookie parsing when value is undefined
cakephp · Sep 22, 2023 · 34b4920 · 34b4920
2 parents c92a3c0 + 197dd4b
commit 34b4920
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 3 deletions.
diff --git a/src/Http/Cookie/Cookie.php b/src/Http/Cookie/Cookie.php
@@ -284,7 +284,10 @@ public static function createFromHeaderString(string $cookie, array $defaults =
             $parts = preg_split('/\;[ \t]*/', $cookie);
         }
 
-        [$name, $value] = explode('=', array_shift($parts), 2);
+        $nameValue = explode('=', array_shift($parts), 2);
+        $name = array_shift($nameValue);
+        $value = array_shift($nameValue) ?? '';
+
         $data = [
                 'name' => urldecode($name),
                 'value' => urldecode($value),

diff --git a/tests/TestCase/Http/Cookie/CookieTest.php b/tests/TestCase/Http/Cookie/CookieTest.php
@@ -465,7 +465,7 @@ public function testGetId(): void
         $this->assertSame('test;example.com;/path', $cookie->getId());
     }
 
-    public function testCreateFromHeaderString(): void
+    public function testCreateFromHeaderStringInvalidSamesite(): void
     {
         $header = 'cakephp=cakephp-rocks; expires=Wed, 01-Dec-2027 12:00:00 GMT; path=/; domain=cakephp.org; samesite=invalid; secure; httponly';
         $result = Cookie::createFromHeaderString($header);
@@ -475,6 +475,15 @@ public function testCreateFromHeaderString(): void
         $this->assertNull($result->getSameSite());
     }
 
+    public function testCreateFromHeaderStringEmptyValue(): void
+    {
+        // Invalid cookie with no = separator or value.
+        $header = 'cakephp; expires=Wed, 01-Dec-2027 12:00:00 GMT; path=/; domain=cakephp.org;';
+        $result = Cookie::createFromHeaderString($header);
+
+        $this->assertSame('', $result->getValue());
+    }
+
     public function testDefaults(): void
     {
         Cookie::setDefaults(['path' => '/cakephp', 'expires' => time()]);
@@ -494,7 +503,7 @@ public function testInvalidExpiresForDefaults(): void
         $this->expectExceptionMessage('Invalid type `array` for expire');
 
         Cookie::setDefaults(['expires' => ['ompalompa']]);
-        $cookie = new Cookie('cakephp', 'cakephp-rocks');
+        new Cookie('cakephp', 'cakephp-rocks');
     }
 
     public function testInvalidSameSiteForDefaults(): void