Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:111909
To: Stanislav Malyshev <smalyshev@gmail.com>,
 PHP Internals <internals@lists.php.net>
References: <cff5cfdf-ddd2-e7d1-1006-eadf3ab80287@gmail.com>
Message-ID: <b546dfaa-2ad6-b31a-2437-88e044f98a80@gmx.de>
Date: Mon, 21 Sep 2020 10:21:41 +0200
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101
 Thunderbird/78.2.2
MIME-Version: 1.0
In-Reply-To: <cff5cfdf-ddd2-e7d1-1006-eadf3ab80287@gmail.com>
Content-Type: text/plain; charset=utf-8
Content-Language: de-DE
Content-Transfer-Encoding: quoted-printable
Subject: Re: Decoding cookie names
From: cmbecker69@gmx.de ("Christoph M. Becker")

On 21.09.2020 at 03:22, Stanislav Malyshev wrote:

> Hi!
>
> In one of the bug reports there was a question raised - should PHP be
> decoding cookie names? Right now it does. The standard is pretty much
> silent on this, and looks like such behavior leads to security problems:
> https://hackerone.com/reports/895727
>
> However I am not sure whether it's ok to change it, since it fails a
> couple of tests (easy to fix) and may also break some stuff I have no
> idea about. In general, using url-encoded cookie names is very weird,
> but I can't guarantee nobody does it. So, I wonder what exactly should
> we do in this case?
>
> RoR folks just changed the code to not decode cookies.
> Also, php_setcookie() does not seem to encode cookie names (note: we're
> talking names not values here!) when we send them out, so maybe it
> doesn't make sense to decode them when we receive them?
>
> What do you think?

Indeed, since we don't encode when sending, we should not decode when
receiving.  Consider

    setcookie('foo%2fbar', 'value');

That looks perfectly valid to me, but we never get $_COOKIE['foo%2fbar']
back, but instead $_COOKIE['foo/bar'].

Fixing this bug may cause some BC breaks, but since it is apparently
security related, we should fix it nonetheless.

=2D-
Christoph M. Becker