Cookie: add input validation #609

This commit adds input validation for all parameters of the `Cookie::__construct()` method: * For `$name` and `$value`, I've chosen to only accept plain strings and not `Stringable` objects. * The `$attributes` parameter accepts an array or an instance of `CaseInsensitiveDictionary` according to the docs, but the important thing about the `CaseInsensitiveDictionary` part is that if the parameter is passed as an object, it needs to have both `ArrayAccess`, as well as be `Traversable`, so the input validation checks for those characteristics rather than hard-requiring an instance of `CaseInsensitiveDictionary`. * As the `$flags` parameter is used with `array_merge()`, we cannot accept objects, so an array is the only valid input type. * As for `$reference_time`: as the default value is set using `time()`, which returns an integer time stamp, I've implemented the input validation to expect an integer. Includes tests for these new exceptions.

As this method only returns `boolean`, we may as well return boolean `false` instead of throwing an exception. Includes tests.

As this method only returns `boolean`, we may as well return boolean `false` instead of throwing an exception. The input validation in this case is not done at the very start of the function to prevent changing the behaviour of the function for those cases which were already being handled by the method. This is also the reason for using `is_scalar()` instead of `is_string()`. Includes tests.

This adds input validation to the `Cookie::parse()` method for the `$cookie_header` and `$name` parameters. As the `$reference_time` parameter is not directly used in this method, but only passed through to the `Cookie::__construct()` method, no input validation has been added, as it will be validated by the `Cookie::__construct()` method. Includes tests for the new exceptions + a test to safeguard that the "fall through validation for the `$reference_time`" actually happens. Includes fixing up two tests which were passing the wrong value type for an optional parameter.

The first and second argument for the `Cookie::parse_from_headers()` method already have (class-based) type declarations. The third argument - `$time` - is only used to pass it through to the `parse()` method, which will subsequently pass it through to the class constructor which contains input validation for the parameter. This just adds a test to safeguard that the "fall through" validation for the `$time` parameter actually happens.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Cookie: add input validation #609

Cookie: add input validation #609

Commits on Nov 15, 2021