[Security] Fix false-string handling in RememberMeAuthenticator

Author: ossinkine

Authenticator/RememberMeAuthenticator.php

@@ -70,7 +70,7 @@ public function supports(Request $request): ?bool
             return false;
         }
 
-        if (!$request->cookies->has($this->cookieName)) {
+        if (!$request->cookies->has($this->cookieName) || !\is_scalar($request->cookies->all()[$this->cookieName] ?: null)) {
             return false;
         }
 

Tests/Authenticator/RememberMeAuthenticatorTest.php

@@ -61,6 +61,9 @@ public static function provideSupportsData()
         $request = Request::create('/', 'GET', [], ['_remember_me_cookie' => 'rememberme']);
         $request->attributes->set(ResponseListener::COOKIE_ATTR_NAME, new Cookie('_remember_me_cookie', null));
         yield [$request, false];
+
+        $request = Request::create('/', 'GET', [], ['_remember_me_cookie' => '0']);
+        yield [$request, false];
     }
 
     public function testAuthenticate()