fix(Cookie): validate cookie path and domain attributes

[gr8man]

Description
Validates cookie path, domain, and prefix attributes against reserved characters (",; \t\r\n\v\f\0") to prevent CRLF injection in raw cookies and avoid fatal ValueErrors from PHP's native setcookie() and setrawcookie(). Also ensures null attribute options safely fall back to defaults in the constructor.

Checklist:

• Securely signed commits
• Component(s) with PHPDoc blocks, only if necessary or adds value (without duplication)
• Unit testing, with >80% coverage
• User guide updated
• Conforms to style guide

[Copilot]

🟡 Changes recommended

Non-raw prefixes still bypass validation and can cause setcookie() to throw a ValueError.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Adds cookie attribute validation to prevent header injection and native PHP ValueErrors. Review assumes the develop base branch.

Changes:

• Validates cookie paths, domains, and prefixes.
• Defaults nullable cookie options safely.
• Adds tests, messages, and documentation.

File summaries

File	Description
system/Cookie/Cookie.php	Implements normalization and validation.
system/Cookie/Exceptions/CookieException.php	Adds validation exceptions.
system/Language/en/Cookie.php	Adds error messages.
tests/system/Cookie/CookieTest.php	Adds regression coverage.
user_guide_src/source/libraries/cookies.rst	Documents attribute validation.
user_guide_src/source/changelogs/v4.7.5.rst	Records the fix.

Review details

Suppressed comments (1)

system/Cookie/Cookie.php:458

• withPrefix() has the same non-raw bypass: an invalid prefix is stored unchanged and later causes native setcookie() to throw because prefixes are not URL-encoded by getPrefixedName(). Prefix character validation must run regardless of the cookie's raw mode.

            $this->validateName($prefix, $this->raw);

• Files reviewed: 6/6 changed files
• Comments generated: 1
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

NUL-containing prefixes still bypass validation and may reach PHP’s native cookie functions.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

• Files reviewed: 6/6 changed files
• Comments generated: 1
• Review effort level: Balanced

[michalsn]

Thank you!