Fix #69948: path/domain are not sanitized in setcookie

For improved security, characters not allowed for name and value should
also be forbidden for path and domain.

diff --git a/NEWS b/NEWS
index 1ac402ba8ae1cf8df05f071c23713ffb40f85aac..680ef4ce82d670d4e32311f1b5402b94d206ca3f 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -181,6 +181,7 @@ PHP                                                                        NEWS
   . Fixed bug #75409 (accept EFAULT in addition to ENOSYS as indicator 
     that getrandom() is missing). (sarciszewski)
   . Fixed bug #74719 (fopen() should accept NULL as context). (Alexander Holman)
+  . Fixed bug #69948 (path/domain are not sanitized in setcookie). (cmb)
 
 - Testing:
   . Implemented request #62055 (Make run-tests.php support --CGI-- sections).

diff --git a/ext/standard/head.c b/ext/standard/head.c
index f10c9e52d9b0d9528abfa066500b92de61a82654..5e21638adf9dd91e385626b4a110b5d0db2a04dd 100644 (file)
--- a/ext/standard/head.c
+++ b/ext/standard/head.c
@@ -104,6 +104,16 @@ PHPAPI int php_setcookie(zend_string *name, zend_string *value, time_t expires,
                return FAILURE;
        }
 
+       if (path && strpbrk(ZSTR_VAL(path), ",; \t\r\n\013\014") != NULL) { /* man isspace for \013 and \014 */
+               zend_error(E_WARNING, "Cookie paths cannot contain any of the following ',; \\t\\r\\n\\013\\014'" );
+               return FAILURE;
+       }
+
+       if (domain && strpbrk(ZSTR_VAL(domain), ",; \t\r\n\013\014") != NULL) { /* man isspace for \013 and \014 */
+               zend_error(E_WARNING, "Cookie domains cannot contain any of the following ',; \\t\\r\\n\\013\\014'" );
+               return FAILURE;
+       }
+
        len += ZSTR_LEN(name);
        if (value) {
                if (url_encode) {

diff --git a/ext/standard/tests/network/bug69948.phpt b/ext/standard/tests/network/bug69948.phpt
new file mode 100644 (file)
index 0000000..957d72f
--- /dev/null
+++ b/ext/standard/tests/network/bug69948.phpt
@@ -0,0 +1,18 @@
+--TEST--
+Bug #69948 (path/domain are not sanitized for special characters in setcookie)
+--FILE--
+<?php
+var_dump(
+    setcookie('foo', 'bar', 0, 'asdf;asdf'),
+    setcookie('foo', 'bar', 0, '/', 'foobar; secure')
+);
+?>
+===DONE===
+--EXPECTHEADERS--
+--EXPECTF--
+Warning: Cookie paths cannot contain any of the following ',; \t\r\n\013\014' in %s on line %d
+
+Warning: Cookie domains cannot contain any of the following ',; \t\r\n\013\014' in %s on line %d
+bool(false)
+bool(false)
+===DONE===