Merge branch 'hotfix/ZF2-169' of https://github.com/adamlundrigan/zf2 into hotfix/zf2-169

Author: weierophinney

src/Header/SetCookie.php

@@ -96,6 +96,14 @@ public static function fromString($headerLine, $bypassHeaderFieldName = false)
                         $headerValue = null;
                     }
 
+                    // First K=V pair is always the cookie name and value
+                    if ($header->getName() === NULL) {
+                        $header->setName($headerKey);
+                        $header->setValue($headerValue);
+                        continue;
+                    }
+
+                    // Process the remanining elements
                     switch (str_replace(array('-', '_'), '', strtolower($headerKey))) {
                         case 'expires' : $header->setExpires($headerValue); break;
                         case 'domain'  : $header->setDomain($headerValue); break;
@@ -105,8 +113,7 @@ public static function fromString($headerLine, $bypassHeaderFieldName = false)
                         case 'version' : $header->setVersion((int) $headerValue); break;
                         case 'maxage'  : $header->setMaxAge((int) $headerValue); break;
                         default:
-                            $header->setName($headerKey);
-                            $header->setValue($headerValue);
+                            // Intentionally omitted 
                     }
                 }
 

test/Header/SetCookieTest.php

@@ -129,8 +129,7 @@ public function testSetCookieCanAppendOtherHeadersInWhenCreatingString()
     /** Implmentation specific tests here */
 
     /**
-     * ZF2-169
-     * 
+     * @group ZF2-169
      * @see http://framework.zend.com/issues/browse/ZF2-169
      */
     public function testZF2_169()
@@ -139,5 +138,15 @@ public function testZF2_169()
         $setCookieHeader = SetCookie::fromString($cookie);
         $this->assertEquals($cookie, $setCookieHeader->toString());
     }
+
+    /**
+     * @group ZF2-169
+     */
+    public function testDoesNotAcceptCookieNameFromArbitraryLocationInHeaderValue()
+    {
+        $cookie = 'Set-Cookie: Version=1; Max-Age=1799; Expires=Mon, 20-Feb-2012 02:49:57 GMT; Path=/; leo_auth_token="example"';
+        $setCookieHeader = SetCookie::fromString($cookie);
+        $this->assertNotEquals('leo_auth_token', $setCookieHeader->getName());
+    }
 }