Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Cookie: add input validation #609

Merged
merged 5 commits into from
Nov 15, 2021
Merged

Conversation

jrfnl
Copy link
Member

@jrfnl jrfnl commented Nov 14, 2021

Cookie::__construct(): add input validation

This commit adds input validation for all parameters of the Cookie::__construct() method:

  • For $name and $value, I've chosen to only accept plain strings and not Stringable objects.
  • The $attributes parameter accepts an array or an instance of CaseInsensitiveDictionary according to the docs, but the important thing about the CaseInsensitiveDictionary part is that if the parameter is passed as an object, it needs to have both ArrayAccess, as well as be Traversable, so the input validation checks for those characteristics rather than hard-requiring an instance of CaseInsensitiveDictionary.
  • As the $flags parameter is used with array_merge(), we cannot accept objects, so an array is the only valid input type.
  • As for $reference_time: as the default value is set using time(), which returns an integer time stamp, I've implemented the input validation to expect an integer.

Includes tests for these new exceptions.

Cookie::domain_matches(): add input validation

As this method only returns boolean, we may as well return boolean false instead of throwing an exception.

Includes tests.

Cookie::path_matches(): add input validation

As this method only returns boolean, we may as well return boolean false instead of throwing an exception.

The input validation in this case is not done at the very start of the function to prevent changing the behaviour of the function for those cases which were already being handled by the method. This is also the reason for using is_scalar() instead of is_string().

Includes tests.

Cookie::parse(): add input validation

This adds input validation to the Cookie::parse() method for the $cookie_header and $name parameters.

As the $reference_time parameter is not directly used in this method, but only passed through to the Cookie::__construct() method, no input validation has been added, as it will be validated by the Cookie::__construct() method.

Includes tests for the new exceptions + a test to safeguard that the "fall through validation for the $reference_time" actually happens.

Includes fixing up two tests which were passing the wrong value type for an optional parameter.

Cookie::parse_from_headers(): add test safeguarding input validation

The first and second argument for the Cookie::parse_from_headers() method already have (class-based) type declarations.
The third argument - $time - is only used to pass it through to the parse() method, which will subsequently pass it through to the class constructor which contains input validation for the parameter.

This just adds a test to safeguard that the "fall through" validation for the $time parameter actually happens.


Regarding the other public methods:

  • The uri_matches() method already has a class based type declaration.
  • The other public methods do not take parameters.

This commit adds input validation for all parameters of the `Cookie::__construct()` method:
* For `$name` and `$value`, I've chosen to only accept plain strings and not `Stringable` objects.
* The `$attributes` parameter accepts an array or an instance of `CaseInsensitiveDictionary` according to the docs, but the important thing about the `CaseInsensitiveDictionary` part is that if the parameter is passed as an object, it needs to have both `ArrayAccess`, as well as be `Traversable`, so the input validation checks for those characteristics rather than hard-requiring an instance of `CaseInsensitiveDictionary`.
* As the `$flags` parameter is used with `array_merge()`, we cannot accept objects, so an array is the only valid input type.
* As for `$reference_time`: as the default value is set using `time()`, which returns an integer time stamp, I've implemented the input validation to expect an integer.

Includes tests for these new exceptions.
As this method only returns `boolean`, we may as well return boolean `false` instead of throwing an exception.

Includes tests.
As this method only returns `boolean`, we may as well return boolean `false` instead of throwing an exception.

The input validation in this case is not done at the very start of the function to prevent changing the behaviour of the function for those cases which were already being handled by the method. This is also the reason for using `is_scalar()` instead of `is_string()`.

Includes tests.
@jrfnl jrfnl force-pushed the feature/cookie-add-input-validation branch from 1d9062e to 10c5b15 Compare November 15, 2021 13:35
This adds input validation to the `Cookie::parse()` method for the `$cookie_header` and `$name` parameters.

As the `$reference_time` parameter is not directly used in this method, but only passed through to the `Cookie::__construct()` method, no input validation has been added, as it will be validated by the `Cookie::__construct()` method.

Includes tests for the new exceptions + a test to safeguard that the "fall through validation for the `$reference_time`" actually happens.

Includes fixing up two tests which were passing the wrong value type for an optional parameter.
The first and second argument for the `Cookie::parse_from_headers()` method already have (class-based) type declarations.
The third argument - `$time` - is only used to pass it through to the `parse()` method, which will subsequently pass it through to the class constructor which contains input validation for the parameter.

This just adds a test to safeguard that the "fall through" validation for the `$time` parameter actually happens.
@jrfnl jrfnl force-pushed the feature/cookie-add-input-validation branch from 10c5b15 to 3aa2065 Compare November 15, 2021 13:40
@schlessera schlessera merged commit f24416e into develop Nov 15, 2021
@schlessera schlessera deleted the feature/cookie-add-input-validation branch November 15, 2021 13:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants