Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:111908
To: PHP Internals <internals@lists.php.net>
Message-ID: <cff5cfdf-ddd2-e7d1-1006-eadf3ab80287@gmail.com>
Date: Sun, 20 Sep 2020 18:22:24 -0700
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:78.0)
 Gecko/20100101 Thunderbird/78.2.2
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 8bit
Subject: Decoding cookie names
From: smalyshev@gmail.com (Stanislav Malyshev)

Hi!

In one of the bug reports there was a question raised - should PHP be 
decoding cookie names? Right now it does. The standard is pretty much 
silent on this, and looks like such behavior leads to security problems: 
https://hackerone.com/reports/895727

However I am not sure whether it's ok to change it, since it fails a 
couple of tests (easy to fix) and may also break some stuff I have no 
idea about. In general, using url-encoded cookie names is very weird, 
but I can't guarantee nobody does it. So, I wonder what exactly should 
we do in this case?

RoR folks just changed the code to not decode cookies.
Also, php_setcookie() does not seem to encode cookie names (note: we're 
talking names not values here!) when we send them out, so maybe it 
doesn't make sense to decode them when we receive them?

What do you think?
-- 
Stas Malyshev
smalyshev@gmail.com