PHP :: Bug #53879 :: DateTime::createFromFormat() fails to parse cookie expiration date

Bug #53879	DateTime::createFromFormat() fails to parse cookie expiration date
Submitted:	2011-01-29 16:43 UTC	Modified:	2013-11-27 17:46 UTC
From:	noels01 at gmx dot net	Assigned:
Status:	Closed	Package:	Date/time related
PHP Version:	5.3.5	OS:	Win 7
Private report:	No	CVE-ID:	None

View Developer Edit

Welcome! If you don't have a Git account, you can't do anything here.
If you reported this bug, you can edit this bug over here.

php.net Username: php.net Password:

Quick Fix:	(description)
	Block user comment
Status:		Assign to:
Package:
Bug Type:
Summary:
From:	noels01 at gmx dot net
New email:
PHP Version:		OS:

New/Additional Comment:

[2011-01-29 16:43 UTC] noels01 at gmx dot net

Description:
------------
The class DateTime is supposed to handle date strings like used for cookie expiration dates. It explicitly defines the format DateTime::COOKIE but fails to parse it.

Test script:
---------------
<?php

$date = DateTime::createFromFormat(DateTime::COOKIE, "Mon, 21-Jan-2041 15:24:52 GMT");
print_r($date);

?>

Same goes for 

<?php

$date = date_parse_from_format(DateTime::COOKIE, "Mon, 21-Jan-2041 15:24:52 GMT");
print_r($date);

?>

Expected result:
----------------
Something with a date instead of NULL O.o

Actual result:
--------------
Array
(
    [year] => 2020
    [month] => 1
    [day] => 21
    [hour] => 41
    [minute] => 15
    [second] => 24
    [fraction] =>
    [warning_count] => 1
    [warnings] => Array
        (
            [25] => The parsed time was invalid
        )

    [error_count] => 4
    [errors] => Array
        (
            [16] => Unexpected data found.
            [22] => The timezone could not be found in the database
            [25] => Trailing data
        )

    [is_localtime] => 1
    [zone_type] => 0
)

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports

[2012-09-29 17:33 UTC] bwhitehead at tableausoftware dot com

Confirmed on MacOS 10.7.4 (PHP 5.3.10)

According to this page:
http://php.net/manual/en/class.datetime.php:
   const string COOKIE = "l, d-M-y H:i:s T" ;

According to this page: 
http://php.net/manual/en/datetime.createfromformat.php
  Value should be:"D, d-M-Y H:i:s T" or "D, d-M-Y H:i:s e"

The leading "Day of Week" (l) and "Year" (y) formats are incorrect.

Confirmed parsing of standard cookie date with either of the above formats.

Code:
DateTime::createFromFormat("D, d-M-Y H:i:s T", "Mon, 29-Sep-2014 01:21:00 GMT");
DateTime::createFromFormat("D, d-M-Y H:i:s e", "Mon, 29-Sep-2014 01:21:00 GMT");

Result:
object(DateTime)#1 (3) {
  ["date"]=>
  string(19) "2014-09-29 01:21:00"
  ["timezone_type"]=>
  int(2)
  ["timezone"]=>
  string(3) "GMT"
}
array(4) {
  ["warning_count"]=>
  int(0)
  ["warnings"]=>
  array(0) {
  }
  ["error_count"]=>
  int(0)
  ["errors"]=>
  array(0) {
  }
}

[2013-11-27 17:44 UTC] derick@php.net

The original cookie spec uses RFC 850, which has the year with only two digits. So this is technically not a bug - however - it's not really nice either. The l vs D point is moot, as the createFromFormat treats them as the same. However, I think we should change the COOKIE format to what http://en.wikipedia.org/wiki/HTTP_cookie#Expires_and_Max-Age and RFC 1036 say: "Tue, 15 Jan 2013 21:47:38 GMT" or as format specifiers: "l, d M Y H:i:s T" (ie, swap y for Y, and remove the -'s between d, M and Y).

[2013-11-27 17:44 UTC] derick@php.net

But then http://curl.haxx.se/rfc/cookie_spec.html says they should be dashes... :-)

[2013-11-27 17:46 UTC] derick@php.net

So I guess we should just change the y to Y - I'll cook up a patch tonight.