Merge pull request #40 from weierophinney/security/do-not-decode-cookie-names

Do not decode cookie names, just values

Author: simensen

src/Dflydev/FigCookies/StringUtil.php

@@ -5,11 +5,11 @@
 namespace Dflydev\FigCookies;
 
 use function array_filter;
-use function array_map;
 use function assert;
 use function explode;
 use function is_array;
 use function preg_split;
+use function urldecode;
 
 class StringUtil
 {
@@ -27,8 +27,8 @@ public static function splitOnAttributeDelimiter(string $string) : array
  public static function splitCookiePair(string $string) : array
  {
  $pairParts = explode('=', $string, 2);
- $pairParts[1] = $pairParts[1] ?? '';
+ $pairParts[1] = urldecode($pairParts[1]) ?? '';
 
- return array_map('urldecode', $pairParts);
+ return $pairParts;
  }
 }

tests/Dflydev/FigCookies/CookieTest.php

@@ -52,7 +52,7 @@ public function provideParsesOneFromCookieStringData() : array
  {
  return [
  ['someCookie=something', 'someCookie', 'something'],
- ['hello%3Dworld=how%22are%27you', 'hello=world', 'how"are\'you'],
+ ['hello%3Dworld=how%22are%27you', 'hello%3Dworld', 'how"are\'you'],
  ['empty=', 'empty', ''],
  ];
  }