Merge branch '6.4' into 7.2

fabpot · fabpot · commit 16227314701c · 2025-05-10T13:58:55.000+02:00
* 6.4:
  Improve readability of disallow_search_engine_index condition
  [Security] Avoid failing when PersistentRememberMeHandler handles a malformed cookie
  [DoctrineBridge] Undefined variable
diff --git a/RememberMe/PersistentRememberMeHandler.php b/RememberMe/PersistentRememberMeHandler.php
@@ -124,7 +124,12 @@ public function clearRememberMeCookie(): void
             return;
         }
 
-        $rememberMeDetails = RememberMeDetails::fromRawCookie($cookie);
+        try {
+            $rememberMeDetails = RememberMeDetails::fromRawCookie($cookie);
+        } catch (AuthenticationException) {
+            // malformed cookie should not fail the response and can be simply ignored
+            return;
+        }
         [$series] = explode(':', $rememberMeDetails->getValue());
         $this->tokenProvider->deleteTokenBySeries($series);
     }
diff --git a/Tests/RememberMe/PersistentRememberMeHandlerTest.php b/Tests/RememberMe/PersistentRememberMeHandlerTest.php
@@ -74,6 +74,22 @@ public function testClearRememberMeCookie()
         $this->assertNull($cookie->getValue());
     }
 
+    public function testClearRememberMeCookieMalformedCookie()
+    {
+        $this->tokenProvider->expects($this->exactly(0))
+            ->method('deleteTokenBySeries');
+
+        $this->request->cookies->set('REMEMBERME', 'malformed');
+
+        $this->handler->clearRememberMeCookie();
+
+        $this->assertTrue($this->request->attributes->has(ResponseListener::COOKIE_ATTR_NAME));
+
+        /** @var Cookie $cookie */
+        $cookie = $this->request->attributes->get(ResponseListener::COOKIE_ATTR_NAME);
+        $this->assertNull($cookie->getValue());
+    }
+
     public function testConsumeRememberMeCookieValid()
     {
         $this->tokenProvider->expects($this->any())

Original file line number	Diff line number	Diff line change
`@@ -124,7 +124,12 @@ public function clearRememberMeCookie(): void`
`124`	`124`	`return;`
`125`	`125`	`}`
`126`	`126`
`127`		`- $rememberMeDetails = RememberMeDetails::fromRawCookie($cookie);`
	`127`	`+ try {`
	`128`	`+ $rememberMeDetails = RememberMeDetails::fromRawCookie($cookie);`
	`129`	`+ } catch (AuthenticationException) {`
	`130`	`+ // malformed cookie should not fail the response and can be simply ignored`
	`131`	`+ return;`
	`132`	`+ }`
`128`	`133`	`[$series] = explode(':', $rememberMeDetails->getValue());`
`129`	`134`	`$this->tokenProvider->deleteTokenBySeries($series);`
`130`	`135`	`}`