[BrowserKit] changed Cookie::fromString() to not take the secure setting into account if the URL is not present or is not HTTPS

src/Symfony/Component/BrowserKit/Cookie.php

@@ -141,6 +141,11 @@ class Cookie
             $part = trim($part);
 
             if ('secure' === strtolower($part)) {
+                // Ignore the secure flag if the original URI is not given or is not HTTPS
+                if (!$url || !isset($urlParts['scheme']) || 'https' != $urlParts['scheme']) {
+                    continue;
+                }
+
                 $values['secure'] = true;
 
                 continue;

tests/Symfony/Tests/Component/BrowserKit/CookieTest.php

@@ -18,9 +18,9 @@ class CookieTest extends \PHPUnit_Framework_TestCase
     /**
      * @dataProvider getTestsForToFromString
      */
-    public function testToFromString($cookie)
+    public function testToFromString($cookie, $url = null)
     {
-        $this->assertEquals($cookie, (string) Cookie::fromString($cookie));
+        $this->assertEquals($cookie, (string) Cookie::fromString($cookie, $url));
     }
 
     public function getTestsForToFromString()
@@ -30,14 +30,20 @@ class CookieTest extends \PHPUnit_Framework_TestCase
             array('foo=bar; expires=Fri, 31-Dec-2010 23:59:59 GMT'),
             array('foo=bar; path=/foo'),
             array('foo=bar; domain=google.com'),
-            array('foo=bar; secure'),
+            array('foo=bar; domain=example.com; secure', 'https://example.com/'),
             array('foo=bar; httponly'),
-            array('foo=bar; domain=google.com; path=/foo; secure; httponly'),
+            array('foo=bar; domain=google.com; path=/foo; secure; httponly', 'https://google.com/'),
             array('foo=bar=baz'),
             array('foo=bar%3Dbaz'),
         );
     }
 
+    public function testFromStringIgnoreSecureFlag()
+    {
+        $this->assertFalse(Cookie::fromString('foo=bar; secure')->isSecure());
+        $this->assertFalse(Cookie::fromString('foo=bar; secure', 'http://example.com/')->isSecure());
+    }
+
     public function testFromStringWithUrl()
     {
         $this->assertEquals('foo=bar; domain=www.example.com', (string) Cookie::FromString('foo=bar', 'http://www.example.com/'));