Harden RFC 10025 cookie parsing

[asllanmaciel]

Pull Request Type

• I have checked there is no other PR open for the same change.

This is a:

• Bug fix
• New feature
• Documentation improvement
• Code quality improvement

Context

Follow-up to #1084 after #1083. The initial patch narrowed cookie whitespace trimming to protocol WSP (SP / HTAB). During review, RFC 10025 was identified as the current cookie specification (it obsoletes RFC 6265) and adds an important first parsing step: a Set-Cookie string containing %x00-08 / %x0A-1F / %x7F must be ignored.

This update separates those two responsibilities instead of treating all control characters as trim candidates.

Fixes #1084.

Detailed Description

• renames the internal cookie whitespace constant to Trim::WHITESPACE_CHARS_RFC10025 and keeps normalization limited to SP / HTAB;
• detects the RFC 10025-disallowed control-character ranges before parsing;
• Cookie::parse() rejects such direct inputs with InvalidArgument instead of silently normalizing them;
• Cookie::parse_from_headers() ignores an invalid Set-Cookie entry and continues processing the other response cookies, matching the RFC's user-agent parsing behavior;
• adds data-driven coverage for all 32 disallowed control-code points plus mixed valid/invalid response headers;
• keeps HTAB valid and normalized as WSP.

RFC reference: https://www.rfc-editor.org/rfc/rfc10025#section-5.6

Quality assurance

• This change does NOT contain a breaking change (invalid cookie strings which were previously accepted are now rejected/ignored as required by RFC 10025).
• I have commented my code, particularly in hard-to-understand areas.
• I have added unit tests to accompany this PR.
• The new behavior is covered by focused tests.
• I have (manually) tested this code to the best of my abilities.
• My code follows the style guidelines of this project.

Validation on PHP 8.3.14 / PHPUnit 10.5.64:

• RED before implementation: 33/33 new cases failed (32 disallowed CTLs + mixed-header ignore case);
• focused cookie suite after implementation: 165 tests / 440 assertions — PASS;
• composer lint: 176 files — PASS;
• PHPCS on the three changed files — PASS;
• git diff --check — PASS;
• full suite on this branch: 3,238 tests / 5,486 assertions, 50 failures, 6 warnings;
• clean develop baseline (6200ba9a): 3,202 tests / 5,410 assertions, the same 50 failures and 6 warnings. The baseline failures are unrelated environment/integration failures (public test-server redirects/proxy availability), so this patch adds no full-suite regressions.

Documentation

No public API feature is added; the behavior is protocol hardening and is covered inline by the RFC-linked comments/tests.

AI assistance

AI-assisted tooling was used to investigate the RFC change, prepare the tests/patch, and compare the branch against a clean upstream baseline. The final code, test results, and scope were reviewed directly by the contributor.

[masakielastic]

One thing we may want to reconsider before merging this: RFC 6265 has been obsoleted by RFC 10025, and the newer Set-Cookie parsing algorithm is slightly stricter than what this PR currently tests.

RFC 10025 first requires a user agent to reject the entire set-cookie-string if it contains:

%x00-08 / %x0A-1F / %x7F

i.e. CTLs excluding HTAB. Only after that validation does it remove leading/trailing WSP (SP / HTAB) from the name/value and attributes.

So the "Non-WSP control characters are not stripped from cookie values" test, which currently preserves VT in the parsed value, may need another look: under RFC 10025, VT (%x0B) should cause the Set-Cookie string to be rejected rather than preserved.

This also suggests that the hardening may need two separate pieces: WSP trimming (SP / HTAB) and CTL validation.

[asllanmaciel]

Good catch on RFC 10025. I updated the PR in 9bdaa17: the cookie WSP constant now references RFC 10025, all %x00-08 / %x0A-1F / %x7F controls are rejected by direct Cookie::parse(), and parse_from_headers() ignores only the invalid Set-Cookie entry so other response cookies continue to be processed. I also replaced the VT-preservation expectation with data-driven coverage for all 32 disallowed control values plus a mixed valid/invalid response-header case. The new tests were RED before the change and are GREEN now (165 focused tests / 440 assertions); lint and changed-file PHPCS pass, and the full-suite failure count is identical to a clean develop baseline.