EE 1.7.0 cookie and login issue (disallowed key characters)

Question

Quite out of the blue on a client site running 1.7.0, all pages loaded after the initial visit rendered the dreaded "Disallowed Key Characters" message.

Upon some investigation, I determined it was the exp_tracker cookie that was triggering this. Its value is being set to a%3A1%3A%7Bi%3A0%3Bs%3A5%3A%22index%22%3B%7D (as an example), which is not passing the Input class' clean_input_keys() function, triggering the error.

So, why this crazy value for the exp_tracker cookie, and why all-of-a-sudden? It continues to get set like this. For now my fix is to comment-out the filtering of the $_COOKIE array.

But, possibly related, I can also no longer login to the control panel - with or without the cookie filtering removed. I log-in, my session ID is set, but I just immediately return to the login screen, no error.

Are these related? Anyone seen this before?

Answer 1

Well once you run that through a URL decoder you can see it's just serialized data being URL encoded for some reason. One of my clients' EE 1.7.1 site has similar serialized data being stored, just not URL encoded, so the serialization aspect is a-ok.

All-of-a-sudden changes like this I find can sometimes be traced back to the webhost updating PHP or Apache versions or the like. It's worth asking them if any such updates were made recently.

Also, since this is apparently a cookie issue, is it replicable in other browsers/platforms?

(I would have posted this as a comment instead of an answer, since it's not really an answer, but the rep system isn't allowing me to comment on things yet... :-/ )

Answer 2

This ended up being resolved via EllisLab support:

I'm fairly sure the Suhosin Extension installed on your PHP installation is running the cookie values, or HTTP headers as a whole, through a filter and potentially removing anything that looks suspicious (like encoded semicolons) and it's also filtering the whitespace as we can see from the inserted underscores.

A support request to the host (Dreamhost) resolved this.