A client id longer than 255 characters makes requests that write metadata fail on MySQL and PostgreSQL #17

Summary

The client id comes from the setono_client_id cookie, which the visitor controls. It's the primary key of setono_client__metadata, a VARCHAR(255). Cookie::fromString() accepts any value without dots as a version 1 cookie, i.e. as the client id, whatever its length.

If the id is longer than 255 characters, every request that writes metadata for that visitor fails with a 500 on MySQL and PostgreSQL:

• PostgreSQL 16: SQLSTATE[22001]: String data, right truncated: 7 ERROR: value too long for type character varying(255)
• MySQL 8.4: SQLSTATE[22001]: String data, right truncated: 1406 Data too long for column 'clientId'

The INSERT runs at kernel.finish_request and throws a DriverException. The persister only catches UniqueConstraintViolationException. SQLite doesn't enforce the length, so the problem doesn't show there.

Only the visitor with such a cookie is affected, and requests that don't change metadata keep working. But a corrupted cookie is enough, and the visitor can't recover until the cookie expires or is deleted. For example, an application that stores tracking parameters on landing pages would return a 500 on every landing page for that visitor.

Reproduction

In the test application from #13, with DATABASE_URL pointing at MySQL or PostgreSQL:

$this->browser->getCookieJar()->set(new Cookie('setono_client_id', str_repeat('a', 300), null, '/', 'localhost'));
$this->browser->request('GET', '/metadata/set?key=foo&value=bar');

// 500

Possible fix

Treat a cookie whose client id can't be stored as invalid, so the visitor becomes a new client. For example, RequestBasedCookieProvider could return null when the client id is longer than 255 characters, or contains characters a generated id never has.