updated-packages

vendor/zendframework/zend-http/src/Header/AbstractAccept.php

@@ -77,7 +77,7 @@ abstract class AbstractAccept implements HeaderInterface
      * Factory method: parse Accept header string
      *
      * @param  string $headerLine
-     * @return Accept
+     * @return static
      */
     public static function fromString($headerLine)
     {
@@ -242,7 +242,7 @@ abstract class AbstractAccept implements HeaderInterface
      * @param  int|float $priority
      * @param  array (optional) $params
      * @throws Exception\InvalidArgumentException
-     * @return Accept
+     * @return $this
      */
     protected function addType($type, $priority = 1, array $params = [])
     {

vendor/zendframework/zend-http/src/Header/AbstractDate.php

@@ -65,7 +65,7 @@ abstract class AbstractDate implements HeaderInterface
      * Create date-based header from string
      *
      * @param string $headerLine
-     * @return AbstractDate
+     * @return static
      * @throws Exception\InvalidArgumentException
      */
     public static function fromString($headerLine)
@@ -90,9 +90,7 @@ abstract class AbstractDate implements HeaderInterface
      * Create date-based header from strtotime()-compatible string
      *
      * @param int|string $time
-     *
-     * @return self
-     *
+     * @return static
      * @throws Exception\InvalidArgumentException
      */
     public static function fromTimeString($time)
@@ -104,9 +102,7 @@ abstract class AbstractDate implements HeaderInterface
      * Create date-based header from Unix timestamp
      *
      * @param int $time
-     *
-     * @return self
-     *
+     * @return static
      * @throws Exception\InvalidArgumentException
      */
     public static function fromTimestamp($time)
@@ -156,7 +152,7 @@ abstract class AbstractDate implements HeaderInterface
      * Set the date for this header, this can be a string or an instance of \DateTime
      *
      * @param string|DateTime $date
-     * @return AbstractDate
+     * @return $this
      * @throws Exception\InvalidArgumentException
      */
     public function setDate($date)

vendor/zendframework/zend-http/src/Header/AbstractLocation.php

@@ -35,7 +35,7 @@ abstract class AbstractLocation implements HeaderInterface
      * Create location-based header from string
      *
      * @param string $headerLine
-     * @return AbstractLocation
+     * @return static
      * @throws Exception\InvalidArgumentException
      */
     public static function fromString($headerLine)
@@ -62,7 +62,7 @@ abstract class AbstractLocation implements HeaderInterface
      * Set the URI/URL for this header, this can be a string or an instance of Zend\Uri\Http
      *
      * @param string|UriInterface $uri
-     * @return AbstractLocation
+     * @return $this
      * @throws Exception\InvalidArgumentException
      */
     public function setUri($uri)

vendor/zendframework/zend-http/src/Header/Accept.php

@@ -47,7 +47,7 @@ class Accept extends AbstractAccept
      * @param  string $type
      * @param  int|float $priority
      * @param  array $params
-     * @return Accept
+     * @return $this
      */
     public function addMediaType($type, $priority = 1, array $params = [])
     {

vendor/zendframework/zend-http/src/Header/Accept/FieldValuePart/AbstractFieldValuePart.php

@@ -38,7 +38,7 @@ abstract class AbstractFieldValuePart
      * Set a Field Value Part this Field Value Part matched against.
      *
      * @param AbstractFieldValuePart $matchedAgainst
-     * @return AbstractFieldValuePart provides fluent interface
+     * @return $this
      */
     public function setMatchedAgainst(AbstractFieldValuePart $matchedAgainst)
     {

vendor/zendframework/zend-http/src/Header/AcceptCharset.php

@@ -43,7 +43,7 @@ class AcceptCharset extends AbstractAccept
      *
      * @param  string $type
      * @param  int|float $priority
-     * @return Accept
+     * @return $this
      */
     public function addCharset($type, $priority = 1)
     {

vendor/zendframework/zend-http/src/Header/AcceptEncoding.php

@@ -43,7 +43,7 @@ class AcceptEncoding extends AbstractAccept
      *
      * @param  string $type
      * @param  int|float $priority
-     * @return Accept
+     * @return $this
      */
     public function addEncoding($type, $priority = 1)
     {

vendor/zendframework/zend-http/src/Header/AcceptLanguage.php

@@ -43,7 +43,7 @@ class AcceptLanguage extends AbstractAccept
      *
      * @param  string $type
      * @param  int|float $priority
-     * @return Accept
+     * @return $this
      */
     public function addLanguage($type, $priority = 1)
     {

vendor/zendframework/zend-http/src/Header/AcceptRanges.php

@@ -27,14 +27,12 @@ class AcceptRanges implements HeaderInterface
             );
         }
 
-        $header = new static($value);
-
-        return $header;
+        return new static($value);
     }
 
     public function __construct($rangeUnit = null)
     {
-        if ($rangeUnit) {
+        if ($rangeUnit !== null) {
             $this->setRangeUnit($rangeUnit);
         }
     }
@@ -58,7 +56,7 @@ class AcceptRanges implements HeaderInterface
 
     public function getRangeUnit()
     {
-        return $this->rangeUnit;
+        return (string) $this->rangeUnit;
     }
 
     public function toString()

vendor/zendframework/zend-http/src/Header/Age.php

@@ -25,7 +25,7 @@ class Age implements HeaderInterface
      * Create Age header from string
      *
      * @param string $headerLine
-     * @return Age
+     * @return static
      * @throws Exception\InvalidArgumentException
      */
     public static function fromString($headerLine)
@@ -37,14 +37,12 @@ class Age implements HeaderInterface
             throw new Exception\InvalidArgumentException('Invalid header line for Age string: "' . $name . '"');
         }
 
-        $header = new static($value);
-
-        return $header;
+        return new static($value);
     }
 
     public function __construct($deltaSeconds = null)
     {
-        if ($deltaSeconds) {
+        if ($deltaSeconds !== null) {
             $this->setDeltaSeconds($deltaSeconds);
         }
     }
@@ -62,18 +60,18 @@ class Age implements HeaderInterface
     /**
      * Get header value (number of seconds)
      *
-     * @return int
+     * @return string
      */
     public function getFieldValue()
     {
-        return $this->getDeltaSeconds();
+        return (string) $this->getDeltaSeconds();
     }
 
     /**
      * Set number of seconds
      *
      * @param int $delta
-     * @return RetryAfter
+     * @return $this
      */
     public function setDeltaSeconds($delta)
     {

vendor/zendframework/zend-http/src/Header/Allow.php

@@ -39,7 +39,7 @@ class Allow implements HeaderInterface
      * Create Allow header from header line
      *
      * @param string $headerLine
-     * @return Allow
+     * @return static
      * @throws Exception\InvalidArgumentException
      */
     public static function fromString($headerLine)
@@ -102,7 +102,7 @@ class Allow implements HeaderInterface
      * Allow methods or list of methods
      *
      * @param array|string $allowedMethods
-     * @return Allow
+     * @return $this
      */
     public function allowMethods($allowedMethods)
     {
@@ -124,7 +124,7 @@ class Allow implements HeaderInterface
      * Disallow methods or list of methods
      *
      * @param array|string $disallowedMethods
-     * @return Allow
+     * @return $this
      */
     public function disallowMethods($disallowedMethods)
     {
@@ -146,7 +146,7 @@ class Allow implements HeaderInterface
      * Convenience alias for @see disallowMethods()
      *
      * @param array|string $disallowedMethods
-     * @return Allow
+     * @return $this
      */
     public function denyMethods($disallowedMethods)
     {

vendor/zendframework/zend-http/src/Header/AuthenticationInfo.php

@@ -31,14 +31,12 @@ class AuthenticationInfo implements HeaderInterface
         }
 
         // @todo implementation details
-        $header = new static($value);
-
-        return $header;
+        return new static($value);
     }
 
     public function __construct($value = null)
     {
-        if ($value) {
+        if ($value !== null) {
             HeaderValue::assertValid($value);
             $this->value = $value;
         }
@@ -51,7 +49,7 @@ class AuthenticationInfo implements HeaderInterface
 
     public function getFieldValue()
     {
-        return $this->value;
+        return (string) $this->value;
     }
 
     public function toString()

vendor/zendframework/zend-http/src/Header/Authorization.php

@@ -31,14 +31,12 @@ class Authorization implements HeaderInterface
         }
 
         // @todo implementation details
-        $header = new static($value);
-
-        return $header;
+        return new static($value);
     }
 
     public function __construct($value = null)
     {
-        if ($value) {
+        if ($value !== null) {
             HeaderValue::assertValid($value);
             $this->value = $value;
         }
@@ -51,7 +49,7 @@ class Authorization implements HeaderInterface
 
     public function getFieldValue()
     {
-        return $this->value;
+        return (string) $this->value;
     }
 
     public function toString()

vendor/zendframework/zend-http/src/Header/CacheControl.php

@@ -30,7 +30,7 @@ class CacheControl implements HeaderInterface
      *
      * @param string $headerLine
      * @throws Exception\InvalidArgumentException
-     * @return CacheControl
+     * @return static
      */
     public static function fromString($headerLine)
     {
@@ -83,7 +83,7 @@ class CacheControl implements HeaderInterface
      *
      * @param string $key
      * @param string|bool $value
-     * @return CacheControl - provides the fluent interface
+     * @return $this
      */
     public function addDirective($key, $value = true)
     {
@@ -121,7 +121,7 @@ class CacheControl implements HeaderInterface
      * Remove a directive
      *
      * @param string $key
-     * @return CacheControl - provides the fluent interface
+     * @return $this
      */
     public function removeDirective($key)
     {

vendor/zendframework/zend-http/src/Header/Connection.php

@@ -26,7 +26,7 @@ class Connection implements HeaderInterface
 
     /**
      * @param string $headerLine
-     * @return Connection
+     * @return static
      * @throws Exception\InvalidArgumentException
      */
     public static function fromString($headerLine)
@@ -49,7 +49,7 @@ class Connection implements HeaderInterface
      * Set Connection header to define persistent connection
      *
      * @param  bool $flag
-     * @return Connection
+     * @return $this
      */
     public function setPersistent($flag)
     {
@@ -74,7 +74,7 @@ class Connection implements HeaderInterface
      * RFC allows any token as value, 'close' and 'keep-alive' are commonly used
      *
      * @param string $value
-     * @return Connection
+     * @return $this
      */
     public function setValue($value)
     {

vendor/zendframework/zend-http/src/Header/ContentDisposition.php

@@ -31,14 +31,12 @@ class ContentDisposition implements HeaderInterface
         }
 
         // @todo implementation details
-        $header = new static($value);
-
-        return $header;
+        return new static($value);
     }
 
     public function __construct($value = null)
     {
-        if ($value) {
+        if ($value !== null) {
             HeaderValue::assertValid($value);
             $this->value = $value;
         }
@@ -51,7 +49,7 @@ class ContentDisposition implements HeaderInterface
 
     public function getFieldValue()
     {
-        return $this->value;
+        return (string) $this->value;
     }
 
     public function toString()

vendor/zendframework/zend-http/src/Header/ContentEncoding.php

@@ -30,14 +30,12 @@ class ContentEncoding implements HeaderInterface
         }
 
         // @todo implementation details
-        $header = new static($value);
-
-        return $header;
+        return new static($value);
     }
 
     public function __construct($value = null)
     {
-        if ($value) {
+        if ($value !== null) {
             HeaderValue::assertValid($value);
             $this->value = $value;
         }
@@ -50,7 +48,7 @@ class ContentEncoding implements HeaderInterface
 
     public function getFieldValue()
     {
-        return $this->value;
+        return (string) $this->value;
     }
 
     public function toString()

vendor/zendframework/zend-http/src/Header/ContentLanguage.php

@@ -31,14 +31,12 @@ class ContentLanguage implements HeaderInterface
         }
 
         // @todo implementation details
-        $header = new static($value);
-
-        return $header;
+        return new static($value);
     }
 
     public function __construct($value = null)
     {
-        if ($value) {
+        if ($value !== null) {
             HeaderValue::assertValid($value);
             $this->value = $value;
         }
@@ -51,7 +49,7 @@ class ContentLanguage implements HeaderInterface
 
     public function getFieldValue()
     {
-        return $this->value;
+        return (string) $this->value;
     }
 
     public function toString()

vendor/zendframework/zend-http/src/Header/ContentLength.php

@@ -31,9 +31,7 @@ class ContentLength implements HeaderInterface
         }
 
         // @todo implementation details
-        $header = new static($value);
-
-        return $header;
+        return new static($value);
     }
 
     public function __construct($value = null)
@@ -51,7 +49,7 @@ class ContentLength implements HeaderInterface
 
     public function getFieldValue()
     {
-        return $this->value;
+        return (string) $this->value;
     }
 
     public function toString()

vendor/zendframework/zend-http/src/Header/ContentMD5.php

@@ -28,14 +28,12 @@ class ContentMD5 implements HeaderInterface
         }
 
         // @todo implementation details
-        $header = new static($value);
-
-        return $header;
+        return new static($value);
     }
 
     public function __construct($value = null)
     {
-        if ($value) {
+        if ($value !== null) {
             HeaderValue::assertValid($value);
             $this->value = $value;
         }
@@ -48,7 +46,7 @@ class ContentMD5 implements HeaderInterface
 
     public function getFieldValue()
     {
-        return $this->value;
+        return (string) $this->value;
     }
 
     public function toString()

vendor/zendframework/zend-http/src/Header/ContentRange.php

@@ -31,14 +31,12 @@ class ContentRange implements HeaderInterface
         }
 
         // @todo implementation details
-        $header = new static($value);
-
-        return $header;
+        return new static($value);
     }
 
     public function __construct($value = null)
     {
-        if ($value) {
+        if ($value !== null) {
             HeaderValue::assertValid($value);
             $this->value = $value;
         }
@@ -51,7 +49,7 @@ class ContentRange implements HeaderInterface
 
     public function getFieldValue()
     {
-        return $this->value;
+        return (string) $this->value;
     }
 
     public function toString()

vendor/zendframework/zend-http/src/Header/ContentSecurityPolicy.php

@@ -8,11 +8,11 @@
 namespace Zend\Http\Header;
 
 /**
- * Content Security Policy 1.0 Header
+ * Content Security Policy Level 3 Header
  *
  * @link http://www.w3.org/TR/CSP/
  */
-class ContentSecurityPolicy implements HeaderInterface
+class ContentSecurityPolicy implements MultipleHeaderInterface
 {
     /**
      * Valid directive names
@@ -21,17 +21,44 @@ class ContentSecurityPolicy implements HeaderInterface
      */
     protected $validDirectiveNames = [
         // As per http://www.w3.org/TR/CSP/#directives
-        'default-src',
-        'script-src',
-        'object-src',
-        'style-src',
-        'img-src',
-        'media-src',
-        'frame-src',
-        'font-src',
+        // Fetch directives
+        'child-src',
         'connect-src',
+        'default-src',
+        'font-src',
+        'frame-src',
+        'img-src',
+        'manifest-src',
+        'media-src',
+        'object-src',
+        'prefetch-src',
+        'script-src',
+        'script-src-elem',
+        'script-src-attr',
+        'style-src',
+        'style-src-elem',
+        'style-src-attr',
+        'worker-src',
+
+        // Document directives
+        'base-uri',
+        'plugin-types',
         'sandbox',
+
+        // Navigation directives
+        'form-action',
+        'frame-ancestors',
+        'navigate-to',
+
+        // Reporting directives
         'report-uri',
+        'report-to',
+
+        // Other directives
+        'block-all-mixed-content',
+        'require-sri-for',
+        'trusted-types',
+        'upgrade-insecure-requests',
     ];
 
     /**
@@ -58,7 +85,7 @@ class ContentSecurityPolicy implements HeaderInterface
      *
      * @param string $name The directive name.
      * @param array $sources The source list.
-     * @return self
+     * @return $this
      * @throws Exception\InvalidArgumentException If the name is not a valid directive name.
      */
     public function setDirective($name, array $sources)
@@ -70,6 +97,21 @@ class ContentSecurityPolicy implements HeaderInterface
                 (string) $name
             ));
         }
+
+        if ($name === 'block-all-mixed-content'
+            || $name === 'upgrade-insecure-requests'
+        ) {
+            if ($sources) {
+                throw new Exception\InvalidArgumentException(sprintf(
+                    'Received value for %s directive; none expected',
+                    $name
+                ));
+            }
+
+            $this->directives[$name] = '';
+            return $this;
+        }
+
         if (empty($sources)) {
             if ('report-uri' === $name) {
                 if (isset($this->directives[$name])) {
@@ -77,13 +119,14 @@ class ContentSecurityPolicy implements HeaderInterface
                 }
                 return $this;
             }
+
             $this->directives[$name] = "'none'";
             return $this;
         }
 
         array_walk($sources, [__NAMESPACE__ . '\HeaderValue', 'assertValid']);
-
         $this->directives[$name] = implode(' ', $sources);
+
         return $this;
     }
 
@@ -91,7 +134,7 @@ class ContentSecurityPolicy implements HeaderInterface
      * Create Content Security Policy header from a given header line
      *
      * @param string $headerLine The header line to parse.
-     * @return self
+     * @return static
      * @throws Exception\InvalidArgumentException If the name field in the given header line does not match.
      */
     public static function fromString($headerLine)
@@ -112,9 +155,12 @@ class ContentSecurityPolicy implements HeaderInterface
         foreach ($tokens as $token) {
             $token = trim($token);
             if ($token) {
-                list($directiveName, $directiveValue) = explode(' ', $token, 2);
+                list($directiveName, $directiveValue) = array_pad(explode(' ', $token, 2), 2, null);
                 if (! isset($header->directives[$directiveName])) {
-                    $header->setDirective($directiveName, [$directiveValue]);
+                    $header->setDirective(
+                        $directiveName,
+                        $directiveValue === null ? [] : [$directiveValue]
+                    );
                 }
             }
         }
@@ -142,7 +188,7 @@ class ContentSecurityPolicy implements HeaderInterface
         foreach ($this->directives as $name => $value) {
             $directives[] = sprintf('%s %s;', $name, $value);
         }
-        return implode(' ', $directives);
+        return str_replace(' ;', ';', implode(' ', $directives));
     }
 
     /**
@@ -154,4 +200,20 @@ class ContentSecurityPolicy implements HeaderInterface
     {
         return sprintf('%s: %s', $this->getFieldName(), $this->getFieldValue());
     }
+
+    public function toStringMultipleHeaders(array $headers)
+    {
+        $strings = [$this->toString()];
+        foreach ($headers as $header) {
+            if (! $header instanceof ContentSecurityPolicy) {
+                throw new Exception\RuntimeException(
+                    'The ContentSecurityPolicy multiple header implementation can only'
+                    . ' accept an array of ContentSecurityPolicy headers'
+                );
+            }
+            $strings[] = $header->toString();
+        }
+
+        return implode("\r\n", $strings) . "\r\n";
+    }
 }

vendor/zendframework/zend-http/src/Header/ContentTransferEncoding.php

@@ -31,14 +31,12 @@ class ContentTransferEncoding implements HeaderInterface
         }
 
         // @todo implementation details
-        $header = new static(strtolower($value));
-
-        return $header;
+        return new static(strtolower($value));
     }
 
     public function __construct($value = null)
     {
-        if ($value) {
+        if ($value !== null) {
             HeaderValue::assertValid($value);
             $this->value = $value;
         }
@@ -51,7 +49,7 @@ class ContentTransferEncoding implements HeaderInterface
 
     public function getFieldValue()
     {
-        return $this->value;
+        return (string) $this->value;
     }
 
     public function toString()

vendor/zendframework/zend-http/src/Header/ContentType.php

@@ -34,7 +34,7 @@ class ContentType implements HeaderInterface
      * Factory method: create an object from a string representation
      *
      * @param  string $headerLine
-     * @return self
+     * @return static
      */
     public static function fromString($headerLine)
     {
@@ -69,7 +69,7 @@ class ContentType implements HeaderInterface
 
     public function __construct($value = null, $mediaType = null)
     {
-        if ($value) {
+        if ($value !== null) {
             HeaderValue::assertValid($value);
             $this->value = $value;
         }
@@ -146,7 +146,7 @@ class ContentType implements HeaderInterface
     public function getFieldValue()
     {
         if (null !== $this->value) {
-            return $this->value;
+            return (string) $this->value;
         }
         return $this->assembleValue();
     }
@@ -155,7 +155,7 @@ class ContentType implements HeaderInterface
      * Set the media type
      *
      * @param  string $mediaType
-     * @return self
+     * @return $this
      */
     public function setMediaType($mediaType)
     {
@@ -172,14 +172,14 @@ class ContentType implements HeaderInterface
      */
     public function getMediaType()
     {
-        return $this->mediaType;
+        return (string) $this->mediaType;
     }
 
     /**
      * Set additional content-type parameters
      *
      * @param  array $parameters
-     * @return self
+     * @return $this
      */
     public function setParameters(array $parameters)
     {
@@ -206,7 +206,7 @@ class ContentType implements HeaderInterface
      * Set the content-type character set encoding
      *
      * @param  string $charset
-     * @return self
+     * @return $this
      */
     public function setCharset($charset)
     {

vendor/zendframework/zend-http/src/Header/Cookie.php

@@ -75,12 +75,20 @@ class Cookie extends ArrayObject implements HeaderInterface
         parent::__construct($array, ArrayObject::ARRAY_AS_PROPS);
     }
 
+    /**
+     * @param bool $encodeValue
+     *
+     * @return $this
+     */
     public function setEncodeValue($encodeValue)
     {
         $this->encodeValue = (bool) $encodeValue;
         return $this;
     }
 
+    /**
+     * @return bool
+     */
     public function getEncodeValue()
     {
         return $this->encodeValue;

vendor/zendframework/zend-http/src/Header/Etag.php

@@ -28,14 +28,12 @@ class Etag implements HeaderInterface
         }
 
         // @todo implementation details
-        $header = new static($value);
-
-        return $header;
+        return new static($value);
     }
 
     public function __construct($value = null)
     {
-        if ($value) {
+        if ($value !== null) {
             HeaderValue::assertValid($value);
             $this->value = $value;
         }
@@ -48,7 +46,7 @@ class Etag implements HeaderInterface
 
     public function getFieldValue()
     {
-        return $this->value;
+        return (string) $this->value;
     }
 
     public function toString()

vendor/zendframework/zend-http/src/Header/Expect.php

@@ -28,14 +28,12 @@ class Expect implements HeaderInterface
         }
 
         // @todo implementation details
-        $header = new static($value);
-
-        return $header;
+        return new static($value);
     }
 
     public function __construct($value = null)
     {
-        if ($value) {
+        if ($value !== null) {
             HeaderValue::assertValid($value);
             $this->value = $value;
         }
@@ -48,7 +46,7 @@ class Expect implements HeaderInterface
 
     public function getFieldValue()
     {
-        return $this->value;
+        return (string) $this->value;
     }
 
     public function toString()

vendor/zendframework/zend-http/src/Header/FeaturePolicy.php

@@ -0,0 +1,184 @@
+<?php
+/**
+ * @see       https://github.com/zendframework/zend-http for the canonical source repository
+ * @copyright Copyright (c) 2019 Zend Technologies USA Inc. (https://www.zend.com)
+ * @license   https://github.com/zendframework/zend-http/blob/master/LICENSE.md New BSD License
+ */
+
+namespace Zend\Http\Header;
+
+/**
+ * Feature Policy (based on Editor’s Draft, 28 November 2019)
+ *
+ * @link https://w3c.github.io/webappsec-feature-policy/
+ */
+class FeaturePolicy implements HeaderInterface
+{
+    /**
+     * Valid directive names
+     *
+     * @var string[]
+     *
+     * @see https://github.com/w3c/webappsec-feature-policy/blob/master/features.md
+     */
+    protected $validDirectiveNames = [
+        // Standardized Features
+        'accelerometer',
+        'ambient-light-sensor',
+        'autoplay',
+        'battery',
+        'camera',
+        'display-capture',
+        'document-domain',
+        'fullscreen',
+        'execution-while-not-rendered',
+        'execution-while-out-of-viewport',
+        'gyroscope',
+        'magnetometer',
+        'microphone',
+        'midi',
+        'payment',
+        'picture-in-picture',
+        'sync-xhr',
+        'usb',
+        'wake-lock',
+        'xr',
+
+        // Proposed Features
+        'encrypted-media',
+        'geolocation',
+        'speaker',
+
+        // Experimental Features
+        'document-write',
+        'font-display-late-swap',
+        'layout-animations',
+        'loading-frame-default-eager',
+        'loading-image-default-eager',
+        'legacy-image-formats',
+        'oversized-images',
+        'sync-script',
+        'unoptimized-lossy-images',
+        'unoptimized-lossless-images',
+        'unsized-media',
+        'vertical-scroll',
+        'serial',
+    ];
+
+    /**
+     * The directives defined for this policy
+     *
+     * @var array
+     */
+    protected $directives = [];
+
+    /**
+     * Get the list of defined directives
+     *
+     * @return array
+     */
+    public function getDirectives()
+    {
+        return $this->directives;
+    }
+
+    /**
+     * Sets the directive to consist of the source list
+     *
+     * @param string $name The directive name.
+     * @param string[] $sources The source list.
+     * @return $this
+     * @throws Exception\InvalidArgumentException If the name is not a valid directive name.
+     */
+    public function setDirective($name, array $sources)
+    {
+        if (! in_array($name, $this->validDirectiveNames, true)) {
+            throw new Exception\InvalidArgumentException(sprintf(
+                '%s expects a valid directive name; received "%s"',
+                __METHOD__,
+                (string) $name
+            ));
+        }
+        if (empty($sources)) {
+            $this->directives[$name] = "'none'";
+            return $this;
+        }
+
+        array_walk($sources, [__NAMESPACE__ . '\HeaderValue', 'assertValid']);
+
+        $this->directives[$name] = implode(' ', $sources);
+        return $this;
+    }
+
+    /**
+     * Create Feature Policy header from a given header line
+     *
+     * @param string $headerLine The header line to parse.
+     * @return static
+     * @throws Exception\InvalidArgumentException If the name field in the given header line does not match.
+     */
+    public static function fromString($headerLine)
+    {
+        $header = new static();
+        $headerName = $header->getFieldName();
+        list($name, $value) = GenericHeader::splitHeaderLine($headerLine);
+        // Ensure the proper header name
+        if (strcasecmp($name, $headerName) !== 0) {
+            throw new Exception\InvalidArgumentException(sprintf(
+                'Invalid header line for %s string: "%s"',
+                $headerName,
+                $name
+            ));
+        }
+        // As per https://w3c.github.io/webappsec-feature-policy/#algo-parse-policy-directive
+        $tokens = explode(';', $value);
+        foreach ($tokens as $token) {
+            $token = trim($token);
+            if ($token) {
+                list($directiveName, $directiveValue) = array_pad(explode(' ', $token, 2), 2, null);
+                if (! isset($header->directives[$directiveName])) {
+                    $header->setDirective(
+                        $directiveName,
+                        $directiveValue === null ? [] : [$directiveValue]
+                    );
+                }
+            }
+        }
+
+        return $header;
+    }
+
+    /**
+     * Get the header name
+     *
+     * @return string
+     */
+    public function getFieldName()
+    {
+        return 'Feature-Policy';
+    }
+
+    /**
+     * Get the header value
+     *
+     * @return string
+     */
+    public function getFieldValue()
+    {
+        $directives = [];
+        foreach ($this->directives as $name => $value) {
+            $directives[] = sprintf('%s %s;', $name, $value);
+        }
+        return implode(' ', $directives);
+    }
+
+    /**
+     * Return the header as a string
+     *
+     * @return string
+     */
+    public function toString()
+    {
+        return sprintf('%s: %s', $this->getFieldName(), $this->getFieldValue());
+    }
+}

vendor/zendframework/zend-http/src/Header/From.php

@@ -28,14 +28,12 @@ class From implements HeaderInterface
         }
 
         // @todo implementation details
-        $header = new static($value);
-
-        return $header;
+        return new static($value);
     }
 
     public function __construct($value = null)
     {
-        if ($value) {
+        if ($value !== null) {
             HeaderValue::assertValid($value);
             $this->value = $value;
         }
@@ -48,7 +46,7 @@ class From implements HeaderInterface
 
     public function getFieldValue()
     {
-        return $this->value;
+        return (string) $this->value;
     }
 
     public function toString()

vendor/zendframework/zend-http/src/Header/GenericHeader.php

@@ -25,15 +25,14 @@ class GenericHeader implements HeaderInterface
     /**
      * Factory to generate a header object from a string
      *
-     * @static
      * @param string $headerLine
-     * @return GenericHeader
+     * @return static
      */
     public static function fromString($headerLine)
     {
         list($fieldName, $fieldValue) = GenericHeader::splitHeaderLine($headerLine);
-        $header = new static($fieldName, $fieldValue);
-        return $header;
+
+        return new static($fieldName, $fieldValue);
     }
 
     /**
@@ -80,7 +79,7 @@ class GenericHeader implements HeaderInterface
      * Set header field name
      *
      * @param  string $fieldName
-     * @return GenericHeader
+     * @return $this
      * @throws Exception\InvalidArgumentException If the name does not match with RFC 2616 format.
      */
     public function setFieldName($fieldName)
@@ -122,7 +121,7 @@ class GenericHeader implements HeaderInterface
      * Set header field value
      *
      * @param  string $fieldValue
-     * @return GenericHeader
+     * @return $this
      */
     public function setFieldValue($fieldValue)
     {

vendor/zendframework/zend-http/src/Header/HeaderInterface.php

@@ -16,7 +16,7 @@ interface HeaderInterface
      * Factory to generate a header object from a string
      *
      * @param string $headerLine
-     * @return self
+     * @return static
      * @throws Exception\InvalidArgumentException If the header does not match RFC 2616 definition.
      * @see http://tools.ietf.org/html/rfc2616#section-4.2
      */

vendor/zendframework/zend-http/src/Header/Host.php

@@ -28,14 +28,12 @@ class Host implements HeaderInterface
         }
 
         // @todo implementation details
-        $header = new static($value);
-
-        return $header;
+        return new static($value);
     }
 
     public function __construct($value = null)
     {
-        if ($value) {
+        if ($value !== null) {
             HeaderValue::assertValid($value);
             $this->value = $value;
         }
@@ -48,7 +46,7 @@ class Host implements HeaderInterface
 
     public function getFieldValue()
     {
-        return $this->value;
+        return (string) $this->value;
     }
 
     public function toString()

vendor/zendframework/zend-http/src/Header/IfMatch.php

@@ -28,14 +28,12 @@ class IfMatch implements HeaderInterface
         }
 
         // @todo implementation details
-        $header = new static($value);
-
-        return $header;
+        return new static($value);
     }
 
     public function __construct($value = null)
     {
-        if ($value) {
+        if ($value !== null) {
             HeaderValue::assertValid($value);
             $this->value = $value;
         }
@@ -48,7 +46,7 @@ class IfMatch implements HeaderInterface
 
     public function getFieldValue()
     {
-        return $this->value;
+        return (string) $this->value;
     }
 
     public function toString()

vendor/zendframework/zend-http/src/Header/IfNoneMatch.php

@@ -31,14 +31,12 @@ class IfNoneMatch implements HeaderInterface
         }
 
         // @todo implementation details
-        $header = new static($value);
-
-        return $header;
+        return new static($value);
     }
 
     public function __construct($value = null)
     {
-        if ($value) {
+        if ($value !== null) {
             HeaderValue::assertValid($value);
             $this->value = $value;
         }
@@ -51,7 +49,7 @@ class IfNoneMatch implements HeaderInterface
 
     public function getFieldValue()
     {
-        return $this->value;
+        return (string) $this->value;
     }
 
     public function toString()

vendor/zendframework/zend-http/src/Header/IfRange.php

@@ -28,14 +28,12 @@ class IfRange implements HeaderInterface
         }
 
         // @todo implementation details
-        $header = new static($value);
-
-        return $header;
+        return new static($value);
     }
 
     public function __construct($value = null)
     {
-        if ($value) {
+        if ($value !== null) {
             HeaderValue::assertValid($value);
             $this->value = $value;
         }
@@ -48,7 +46,7 @@ class IfRange implements HeaderInterface
 
     public function getFieldValue()
     {
-        return $this->value;
+        return (string) $this->value;
     }
 
     public function toString()

vendor/zendframework/zend-http/src/Header/KeepAlive.php

@@ -28,14 +28,12 @@ class KeepAlive implements HeaderInterface
         }
 
         // @todo implementation details
-        $header = new static($value);
-
-        return $header;
+        return new static($value);
     }
 
     public function __construct($value = null)
     {
-        if ($value) {
+        if ($value !== null) {
             HeaderValue::assertValid($value);
             $this->value = $value;
         }
@@ -48,7 +46,7 @@ class KeepAlive implements HeaderInterface
 
     public function getFieldValue()
     {
-        return $this->value;
+        return (string) $this->value;
     }
 
     public function toString()

vendor/zendframework/zend-http/src/Header/MaxForwards.php

@@ -31,14 +31,12 @@ class MaxForwards implements HeaderInterface
         }
 
         // @todo implementation details
-        $header = new static($value);
-
-        return $header;
+        return new static($value);
     }
 
     public function __construct($value = null)
     {
-        if ($value) {
+        if ($value !== null) {
             HeaderValue::assertValid($value);
             $this->value = $value;
         }
@@ -51,7 +49,7 @@ class MaxForwards implements HeaderInterface
 
     public function getFieldValue()
     {
-        return $this->value;
+        return (string) $this->value;
     }
 
     public function toString()

vendor/zendframework/zend-http/src/Header/Origin.php

@@ -42,7 +42,7 @@ class Origin implements HeaderInterface
      */
     public function __construct($value = null)
     {
-        if ($value) {
+        if ($value !== null) {
             HeaderValue::assertValid($value);
             $this->value = $value;
         }
@@ -55,7 +55,7 @@ class Origin implements HeaderInterface
 
     public function getFieldValue()
     {
-        return $this->value;
+        return (string) $this->value;
     }
 
     public function toString()

vendor/zendframework/zend-http/src/Header/Pragma.php

@@ -28,14 +28,12 @@ class Pragma implements HeaderInterface
         }
 
         // @todo implementation details
-        $header = new static($value);
-
-        return $header;
+        return new static($value);
     }
 
     public function __construct($value = null)
     {
-        if ($value) {
+        if ($value !== null) {
             HeaderValue::assertValid($value);
             $this->value = $value;
         }
@@ -48,7 +46,7 @@ class Pragma implements HeaderInterface
 
     public function getFieldValue()
     {
-        return $this->value;
+        return (string) $this->value;
     }
 
     public function toString()

vendor/zendframework/zend-http/src/Header/ProxyAuthenticate.php

@@ -31,14 +31,12 @@ class ProxyAuthenticate implements MultipleHeaderInterface
         }
 
         // @todo implementation details
-        $header = new static($value);
-
-        return $header;
+        return new static($value);
     }
 
     public function __construct($value = null)
     {
-        if ($value) {
+        if ($value !== null) {
             HeaderValue::assertValid($value);
             $this->value = $value;
         }
@@ -51,7 +49,7 @@ class ProxyAuthenticate implements MultipleHeaderInterface
 
     public function getFieldValue()
     {
-        return $this->value;
+        return (string) $this->value;
     }
 
     public function toString()

vendor/zendframework/zend-http/src/Header/ProxyAuthorization.php

@@ -31,14 +31,12 @@ class ProxyAuthorization implements HeaderInterface
         }
 
         // @todo implementation details
-        $header = new static($value);
-
-        return $header;
+        return new static($value);
     }
 
     public function __construct($value = null)
     {
-        if ($value) {
+        if ($value !== null) {
             HeaderValue::assertValid($value);
             $this->value = $value;
         }
@@ -51,7 +49,7 @@ class ProxyAuthorization implements HeaderInterface
 
     public function getFieldValue()
     {
-        return $this->value;
+        return (string) $this->value;
     }
 
     public function toString()

vendor/zendframework/zend-http/src/Header/Range.php

@@ -28,14 +28,12 @@ class Range implements HeaderInterface
         }
 
         // @todo implementation details
-        $header = new static($value);
-
-        return $header;
+        return new static($value);
     }
 
     public function __construct($value = null)
     {
-        if ($value) {
+        if ($value !== null) {
             HeaderValue::assertValid($value);
             $this->value = $value;
         }
@@ -48,7 +46,7 @@ class Range implements HeaderInterface
 
     public function getFieldValue()
     {
-        return $this->value;
+        return (string) $this->value;
     }
 
     public function toString()

vendor/zendframework/zend-http/src/Header/Referer.php

@@ -21,7 +21,7 @@ class Referer extends AbstractLocation
      * according to RFC Referer URI should not have fragment
      *
      * @param  string|HttpUri $uri
-     * @return Referer
+     * @return $this
      */
     public function setUri($uri)
     {

vendor/zendframework/zend-http/src/Header/Refresh.php

@@ -28,14 +28,12 @@ class Refresh implements HeaderInterface
         }
 
         // @todo implementation details
-        $header = new static($value);
-
-        return $header;
+        return new static($value);
     }
 
     public function __construct($value = null)
     {
-        if ($value) {
+        if ($value !== null) {
             HeaderValue::assertValid($value);
             $this->value = $value;
         }
@@ -48,7 +46,7 @@ class Refresh implements HeaderInterface
 
     public function getFieldValue()
     {
-        return $this->value;
+        return (string) $this->value;
     }
 
     public function toString()

vendor/zendframework/zend-http/src/Header/RetryAfter.php

@@ -26,7 +26,7 @@ class RetryAfter extends AbstractDate
      * Create Retry-After header from string
      *
      * @param  string $headerLine
-     * @return RetryAfter
+     * @return static
      * @throws Exception\InvalidArgumentException
      */
     public static function fromString($headerLine)
@@ -55,7 +55,7 @@ class RetryAfter extends AbstractDate
      * Set number of seconds
      *
      * @param int $delta
-     * @return RetryAfter
+     * @return $this
      */
     public function setDeltaSeconds($delta)
     {

vendor/zendframework/zend-http/src/Header/Server.php

@@ -1,7 +1,7 @@
 <?php
 /**
  * @see       https://github.com/zendframework/zend-http for the canonical source repository
- * @copyright Copyright (c) 2005-2017 Zend Technologies USA Inc. (http://www.zend.com)
+ * @copyright Copyright (c) 2005-2019 Zend Technologies USA Inc. (http://www.zend.com)
  * @license   https://github.com/zendframework/zend-http/blob/master/LICENSE.md New BSD License
  */
 
@@ -28,14 +28,12 @@ class Server implements HeaderInterface
         }
 
         // @todo implementation details
-        $header = new static($value);
-
-        return $header;
+        return new static($value);
     }
 
     public function __construct($value = null)
     {
-        if ($value) {
+        if ($value !== null) {
             HeaderValue::assertValid($value);
             $this->value = $value;
         }
@@ -48,7 +46,7 @@ class Server implements HeaderInterface
 
     public function getFieldValue()
     {
-        return $this->value;
+        return (string) $this->value;
     }
 
     public function toString()

vendor/zendframework/zend-http/src/Header/SetCookie.php

@@ -1,7 +1,7 @@
 <?php
 /**
  * @see       https://github.com/zendframework/zend-http for the canonical source repository
- * @copyright Copyright (c) 2005-2017 Zend Technologies USA Inc. (http://www.zend.com)
+ * @copyright Copyright (c) 2005-2019 Zend Technologies USA Inc. (https://www.zend.com)
  * @license   https://github.com/zendframework/zend-http/blob/master/LICENSE.md New BSD License
  */
 
@@ -10,6 +10,11 @@ namespace Zend\Http\Header;
 use DateTime;
 use Zend\Uri\UriFactory;
 
+use function array_key_exists;
+use function gettype;
+use function is_scalar;
+use function strtolower;
+
 /**
  * @throws Exception\InvalidArgumentException
  * @see http://www.ietf.org/rfc/rfc2109.txt
@@ -17,6 +22,33 @@ use Zend\Uri\UriFactory;
  */
 class SetCookie implements MultipleHeaderInterface
 {
+    /**
+     * Cookie will not be sent for any cross-domain requests whatsoever.
+     * Even if the user simply navigates to the target site with a regular link, the cookie will not be sent.
+     */
+    const SAME_SITE_STRICT = 'Strict';
+
+    /**
+     * Cookie will not be passed for any cross-domain requests unless it's a regular link that navigates user
+     * to the target site.
+     * Other requests methods (such as POST and PUT) and XHR requests will not contain this cookie.
+     */
+    const SAME_SITE_LAX = 'Lax';
+
+    /**
+     * Cookie will be sent with same-site and cross-site requests.
+     */
+    const SAME_SITE_NONE = 'None';
+
+    /**
+     * @internal
+     */
+    const SAME_SITE_ALLOWED_VALUES = [
+        'strict' => self::SAME_SITE_STRICT,
+        'lax' => self::SAME_SITE_LAX,
+        'none' => self::SAME_SITE_NONE,
+    ];
+
     /**
      * Cookie name
      *
@@ -85,6 +117,16 @@ class SetCookie implements MultipleHeaderInterface
      */
     protected $httponly;
 
+    /**
+     * @var string|null
+     */
+    protected $sameSite;
+
+    /**
+     * @var bool
+     */
+    protected $encodeValue = true;
+
     /**
      * @static
      * @throws Exception\InvalidArgumentException
@@ -99,6 +141,7 @@ class SetCookie implements MultipleHeaderInterface
         if ($setCookieProcessor === null) {
             $setCookieClass = get_called_class();
             $setCookieProcessor = function ($headerLine) use ($setCookieClass) {
+                /** @var SetCookie $header */
                 $header = new $setCookieClass();
                 $keyValuePairs = preg_split('#;\s*#', $headerLine);
 
@@ -115,6 +158,11 @@ class SetCookie implements MultipleHeaderInterface
                     if ($header->getName() === null) {
                         $header->setName($headerKey);
                         $header->setValue(urldecode($headerValue));
+
+                        // set no encode value if raw and encoded values are the same
+                        if (urldecode($headerValue) === $headerValue) {
+                            $header->setEncodeValue(false);
+                        }
                         continue;
                     }
 
@@ -141,6 +189,9 @@ class SetCookie implements MultipleHeaderInterface
                         case 'maxage':
                             $header->setMaxAge($headerValue);
                             break;
+                        case 'samesite':
+                            $header->setSameSite($headerValue);
+                            break;
                         default:
                             // Intentionally omitted
                     }
@@ -179,15 +230,16 @@ class SetCookie implements MultipleHeaderInterface
      *
      * @todo Add validation of each one of the parameters (legal domain, etc.)
      *
-     * @param   string              $name
-     * @param   string              $value
-     * @param   int|string|DateTime $expires
-     * @param   string              $path
-     * @param   string              $domain
-     * @param   bool                $secure
-     * @param   bool                $httponly
-     * @param   string              $maxAge
-     * @param   int                 $version
+     * @param string|null              $name
+     * @param string|null              $value
+     * @param int|string|DateTime|null $expires
+     * @param string|null              $path
+     * @param string|null              $domain
+     * @param bool                     $secure
+     * @param bool                     $httponly
+     * @param int|null                 $maxAge
+     * @param int|null                 $version
+     * @param string|null              $sameSite
      */
     public function __construct(
         $name = null,
@@ -198,7 +250,8 @@ class SetCookie implements MultipleHeaderInterface
         $secure = false,
         $httponly = false,
         $maxAge = null,
-        $version = null
+        $version = null,
+        $sameSite = null
     ) {
         $this->type = 'Cookie';
 
@@ -210,7 +263,24 @@ class SetCookie implements MultipleHeaderInterface
              ->setExpires($expires)
              ->setPath($path)
              ->setSecure($secure)
-             ->setHttpOnly($httponly);
+             ->setHttpOnly($httponly)
+             ->setSameSite($sameSite);
+    }
+
+    /**
+     * @return bool
+     */
+    public function getEncodeValue()
+    {
+        return $this->encodeValue;
+    }
+
+    /**
+     * @param bool $encodeValue
+     */
+    public function setEncodeValue($encodeValue)
+    {
+        $this->encodeValue = (bool) $encodeValue;
     }
 
     /**
@@ -231,7 +301,7 @@ class SetCookie implements MultipleHeaderInterface
             return '';
         }
 
-        $value = urlencode($this->getValue());
+        $value = $this->encodeValue ? urlencode($this->getValue()) : $this->getValue();
         if ($this->hasQuoteFieldValue()) {
             $value = '"' . $value . '"';
         }
@@ -271,13 +341,18 @@ class SetCookie implements MultipleHeaderInterface
             $fieldValue .= '; HttpOnly';
         }
 
+        $sameSite = $this->getSameSite();
+        if ($sameSite !== null && array_key_exists(strtolower($sameSite), self::SAME_SITE_ALLOWED_VALUES)) {
+            $fieldValue .= '; SameSite=' . $sameSite;
+        }
+
         return $fieldValue;
     }
 
     /**
-     * @param string $name
+     * @param  string|null $name
+     * @return $this
      * @throws Exception\InvalidArgumentException
-     * @return SetCookie
      */
     public function setName($name)
     {
@@ -287,7 +362,7 @@ class SetCookie implements MultipleHeaderInterface
     }
 
     /**
-     * @return string
+     * @return string|null
      */
     public function getName()
     {
@@ -295,8 +370,8 @@ class SetCookie implements MultipleHeaderInterface
     }
 
     /**
-     * @param string $value
-     * @return SetCookie
+     * @param  string|null $value
+     * @return $this
      */
     public function setValue($value)
     {
@@ -305,7 +380,7 @@ class SetCookie implements MultipleHeaderInterface
     }
 
     /**
-     * @return string
+     * @return string|null
      */
     public function getValue()
     {
@@ -313,11 +388,9 @@ class SetCookie implements MultipleHeaderInterface
     }
 
     /**
-     * Set version
-     *
-     * @param int $version
+     * @param  int|null $version
+     * @return $this
      * @throws Exception\InvalidArgumentException
-     * @return SetCookie
      */
     public function setVersion($version)
     {
@@ -329,9 +402,7 @@ class SetCookie implements MultipleHeaderInterface
     }
 
     /**
-     * Get version
-     *
-     * @return int
+     * @return int|null
      */
     public function getVersion()
     {
@@ -339,10 +410,8 @@ class SetCookie implements MultipleHeaderInterface
     }
 
     /**
-     * Set Max-Age
-     *
-     * @param int $maxAge
-     * @return SetCookie
+     * @param  int $maxAge
+     * @return $this
      */
     public function setMaxAge($maxAge)
     {
@@ -355,9 +424,7 @@ class SetCookie implements MultipleHeaderInterface
     }
 
     /**
-     * Get Max-Age
-     *
-     * @return int
+     * @return int|null
      */
     public function getMaxAge()
     {
@@ -365,12 +432,8 @@ class SetCookie implements MultipleHeaderInterface
     }
 
     /**
-     * Set Expires
-     *
-     * @param int|string|DateTime $expires
-     *
-     * @return self
-     *
+     * @param  int|string|DateTime|null $expires
+     * @return $this
      * @throws Exception\InvalidArgumentException
      */
     public function setExpires($expires)
@@ -408,13 +471,13 @@ class SetCookie implements MultipleHeaderInterface
     }
 
     /**
-     * @param bool $inSeconds
-     * @return int|string
+     * @param  bool $inSeconds
+     * @return int|string|null
      */
     public function getExpires($inSeconds = false)
     {
         if ($this->expires === null) {
-            return;
+            return null;
         }
         if ($inSeconds) {
             return $this->expires;
@@ -423,8 +486,8 @@ class SetCookie implements MultipleHeaderInterface
     }
 
     /**
-     * @param string $domain
-     * @return SetCookie
+     * @param  string|null $domain
+     * @return $this
      */
     public function setDomain($domain)
     {
@@ -434,7 +497,7 @@ class SetCookie implements MultipleHeaderInterface
     }
 
     /**
-     * @return string
+     * @return string|null
      */
     public function getDomain()
     {
@@ -442,8 +505,8 @@ class SetCookie implements MultipleHeaderInterface
     }
 
     /**
-     * @param string $path
-     * @return SetCookie
+     * @param  string|null $path
+     * @return $this
      */
     public function setPath($path)
     {
@@ -453,7 +516,7 @@ class SetCookie implements MultipleHeaderInterface
     }
 
     /**
-     * @return string
+     * @return string|null
      */
     public function getPath()
     {
@@ -461,8 +524,8 @@ class SetCookie implements MultipleHeaderInterface
     }
 
     /**
-     * @param  bool $secure
-     * @return SetCookie
+     * @param  bool|null $secure
+     * @return $this
      */
     public function setSecure($secure)
     {
@@ -477,7 +540,7 @@ class SetCookie implements MultipleHeaderInterface
      * Set whether the value for this cookie should be quoted
      *
      * @param  bool $quotedValue
-     * @return SetCookie
+     * @return $this
      */
     public function setQuoteFieldValue($quotedValue)
     {
@@ -486,7 +549,7 @@ class SetCookie implements MultipleHeaderInterface
     }
 
     /**
-     * @return bool
+     * @return bool|null
      */
     public function isSecure()
     {
@@ -494,8 +557,8 @@ class SetCookie implements MultipleHeaderInterface
     }
 
     /**
-     * @param  bool $httponly
-     * @return SetCookie
+     * @param  bool|null $httponly
+     * @return $this
      */
     public function setHttponly($httponly)
     {
@@ -507,7 +570,7 @@ class SetCookie implements MultipleHeaderInterface
     }
 
     /**
-     * @return bool
+     * @return bool|null
      */
     public function isHttponly()
     {
@@ -519,7 +582,7 @@ class SetCookie implements MultipleHeaderInterface
      *
      * Always returns false if the cookie is a session cookie (has no expiry time)
      *
-     * @param int $now Timestamp to consider as "now"
+     * @param int|null $now Timestamp to consider as "now"
      * @return bool
      */
     public function isExpired($now = null)
@@ -545,6 +608,35 @@ class SetCookie implements MultipleHeaderInterface
         return ($this->expires === null);
     }
 
+    /**
+     * @return string|null
+     */
+    public function getSameSite()
+    {
+        return $this->sameSite;
+    }
+
+    /**
+     * @param  string|null $sameSite
+     * @return $this
+     * @throws Exception\InvalidArgumentException
+     */
+    public function setSameSite($sameSite)
+    {
+        if ($sameSite === null) {
+            $this->sameSite = null;
+            return $this;
+        }
+        if (! array_key_exists(strtolower($sameSite), self::SAME_SITE_ALLOWED_VALUES)) {
+            throw new Exception\InvalidArgumentException(sprintf(
+                'Invalid value provided for SameSite directive: "%s"; expected one of: Strict, Lax or None',
+                is_scalar($sameSite) ? $sameSite : gettype($sameSite)
+            ));
+        }
+        $this->sameSite = self::SAME_SITE_ALLOWED_VALUES[strtolower($sameSite)];
+        return $this;
+    }
+
     /**
      * Check whether the value for this cookie should be quoted
      *
@@ -555,6 +647,12 @@ class SetCookie implements MultipleHeaderInterface
         return $this->quoteFieldValue;
     }
 
+    /**
+     * @param  string $requestDomain
+     * @param  string $path
+     * @param  bool   $isSecure
+     * @return bool
+     */
     public function isValidForRequest($requestDomain, $path, $isSecure = false)
     {
         if ($this->getDomain() && (strrpos($requestDomain, $this->getDomain()) === false)) {
@@ -577,7 +675,7 @@ class SetCookie implements MultipleHeaderInterface
      *
      * @param string|\Zend\Uri\Uri $uri URI to check against (secure, domain, path)
      * @param bool $matchSessionCookies Whether to send session cookies
-     * @param int $now Override the current time when checking for expiry time
+     * @param int|null $now Override the current time when checking for expiry time
      * @return bool
      * @throws Exception\InvalidArgumentException If URI does not have HTTP or HTTPS scheme.
      */
@@ -624,7 +722,6 @@ class SetCookie implements MultipleHeaderInterface
      *
      * @param  string $cookieDomain
      * @param  string $host
-     *
      * @return bool
      */
     public static function matchCookieDomain($cookieDomain, $host)
@@ -650,11 +747,19 @@ class SetCookie implements MultipleHeaderInterface
         return (strpos($path, $cookiePath) === 0);
     }
 
+    /**
+     * @return string
+     */
     public function toString()
     {
         return 'Set-Cookie: ' . $this->getFieldValue();
     }
 
+    /**
+     * @param  array $headers
+     * @return string
+     * @throws Exception\RuntimeException
+     */
     public function toStringMultipleHeaders(array $headers)
     {
         $headerLine = $this->toString();

vendor/zendframework/zend-http/src/Header/TE.php

@@ -28,14 +28,12 @@ class TE implements HeaderInterface
         }
 
         // @todo implementation details
-        $header = new static($value);
-
-        return $header;
+        return new static($value);
     }
 
     public function __construct($value = null)
     {
-        if ($value) {
+        if ($value !== null) {
             HeaderValue::assertValid($value);
             $this->value = $value;
         }
@@ -48,7 +46,7 @@ class TE implements HeaderInterface
 
     public function getFieldValue()
     {
-        return $this->value;
+        return (string) $this->value;
     }
 
     public function toString()

vendor/zendframework/zend-http/src/Header/Trailer.php

@@ -28,14 +28,12 @@ class Trailer implements HeaderInterface
         }
 
         // @todo implementation details
-        $header = new static($value);
-
-        return $header;
+        return new static($value);
     }
 
     public function __construct($value = null)
     {
-        if ($value) {
+        if ($value !== null) {
             HeaderValue::assertValid($value);
             $this->value = $value;
         }
@@ -48,7 +46,7 @@ class Trailer implements HeaderInterface
 
     public function getFieldValue()
     {
-        return $this->value;
+        return (string) $this->value;
     }
 
     public function toString()

vendor/zendframework/zend-http/src/Header/TransferEncoding.php

@@ -30,14 +30,12 @@ class TransferEncoding implements HeaderInterface
         }
 
         // @todo implementation details
-        $header = new static($value);
-
-        return $header;
+        return new static($value);
     }
 
     public function __construct($value = null)
     {
-        if ($value) {
+        if ($value !== null) {
             HeaderValue::assertValid($value);
             $this->value = $value;
         }
@@ -50,7 +48,7 @@ class TransferEncoding implements HeaderInterface
 
     public function getFieldValue()
     {
-        return $this->value;
+        return (string) $this->value;
     }
 
     public function toString()

vendor/zendframework/zend-http/src/Header/Upgrade.php

@@ -28,14 +28,12 @@ class Upgrade implements HeaderInterface
         }
 
         // @todo implementation details
-        $header = new static($value);
-
-        return $header;
+        return new static($value);
     }
 
     public function __construct($value = null)
     {
-        if ($value) {
+        if ($value !== null) {
             HeaderValue::assertValid($value);
             $this->value = $value;
         }
@@ -48,7 +46,7 @@ class Upgrade implements HeaderInterface
 
     public function getFieldValue()
     {
-        return $this->value;
+        return (string) $this->value;
     }
 
     public function toString()

vendor/zendframework/zend-http/src/Header/UserAgent.php

@@ -28,14 +28,12 @@ class UserAgent implements HeaderInterface
         }
 
         // @todo implementation details
-        $header = new static($value);
-
-        return $header;
+        return new static($value);
     }
 
     public function __construct($value = null)
     {
-        if ($value) {
+        if ($value !== null) {
             HeaderValue::assertValid($value);
             $this->value = $value;
         }
@@ -48,7 +46,7 @@ class UserAgent implements HeaderInterface
 
     public function getFieldValue()
     {
-        return $this->value;
+        return (string) $this->value;
     }
 
     public function toString()

vendor/zendframework/zend-http/src/Header/Vary.php

@@ -28,14 +28,12 @@ class Vary implements HeaderInterface
         }
 
         // @todo implementation details
-        $header = new static($value);
-
-        return $header;
+        return new static($value);
     }
 
     public function __construct($value = null)
     {
-        if ($value) {
+        if ($value !== null) {
             HeaderValue::assertValid($value);
             $this->value = $value;
         }
@@ -48,7 +46,7 @@ class Vary implements HeaderInterface
 
     public function getFieldValue()
     {
-        return $this->value;
+        return (string) $this->value;
     }
 
     public function toString()

vendor/zendframework/zend-http/src/Header/Via.php

@@ -28,14 +28,12 @@ class Via implements HeaderInterface
         }
 
         // @todo implementation details
-        $header = new static($value);
-
-        return $header;
+        return new static($value);
     }
 
     public function __construct($value = null)
     {
-        if ($value) {
+        if ($value !== null) {
             HeaderValue::assertValid($value);
             $this->value = $value;
         }
@@ -48,7 +46,7 @@ class Via implements HeaderInterface
 
     public function getFieldValue()
     {
-        return $this->value;
+        return (string) $this->value;
     }
 
     public function toString()

vendor/zendframework/zend-http/src/Header/WWWAuthenticate.php

@@ -31,14 +31,12 @@ class WWWAuthenticate implements MultipleHeaderInterface
         }
 
         // @todo implementation details
-        $header = new static($value);
-
-        return $header;
+        return new static($value);
     }
 
     public function __construct($value = null)
     {
-        if ($value) {
+        if ($value !== null) {
             HeaderValue::assertValid($value);
             $this->value = $value;
         }
@@ -51,7 +49,7 @@ class WWWAuthenticate implements MultipleHeaderInterface
 
     public function getFieldValue()
     {
-        return $this->value;
+        return (string) $this->value;
     }
 
     public function toString()

vendor/zendframework/zend-http/src/Header/Warning.php

@@ -28,14 +28,12 @@ class Warning implements HeaderInterface
         }
 
         // @todo implementation details
-        $header = new static($value);
-
-        return $header;
+        return new static($value);
     }
 
     public function __construct($value = null)
     {
-        if ($value) {
+        if ($value !== null) {
             HeaderValue::assertValid($value);
             $this->value = $value;
         }
@@ -48,7 +46,7 @@ class Warning implements HeaderInterface
 
     public function getFieldValue()
     {
-        return $this->value;
+        return (string) $this->value;
     }
 
     public function toString()