ps_googleanalytics 6.0.0 - HTTP 500 "Combined size of name and value cannot exceed 4096 characters" on listing pages with long URLs (ga_last_listing stores raw REQUEST_URI) #187

I'd like to report a bug in ps_googleanalytics that turns any long listing URL into a fatal error (HTTP 500).

Describe the bug

On product listing pages (category, manufacturer, etc.), saveInformationAboutListing() stores the full raw REQUEST_URI in the PrestaShop cookie as ga_last_listing. When the URL is long (for example with many filter query parameters), the encrypted cookie exceeds 4096 characters and CookieCore throws a fatal exception in __destruct(), after the page has already been rendered. This produces HTTP 500 responses.

Environment

• PrestaShop 9.1.5, multistore, PHP 8.5
• ps_googleanalytics 6.0.0 (the same code is still on master)
• AmazzingFilter 3.3.5 is also installed. Its filter state makes listing URLs very long, but it does not write to the cookie itself.

Steps to reproduce

1. Install ps_googleanalytics 6.0.0 on PrestaShop 9.1.x
2. Open a listing page (category or manufacturer) with a very long query string (~2,000+ characters), for example many filter parameters:

   GET /brand/123-bloomcabin?autoscroll=1&available_options[c][4]=104%2C2625%2C465%2C...&available_options[f][10]=5944%2C5597&...&filters[c][4][0]=112&...&sliders[p][to]=7419&url_filters=1&url_page=1&url_sorting=1
   

3. Observe an HTTP 500 response

Expected behavior

The listing page should load normally. Analytics listing context should not break the request when the URL is long.

Actual Result

HTTP 500. PHP fatal error:

PHP Fatal error:  Uncaught PrestaShopException: Error during setting a cookie. Combined size of name and value cannot exceed 4096 characters. Larger cookie is not compliant with RFC 2965 and will not be accepted by the browser. in classes/Cookie.php:373
Stack trace:
#0 classes/Cookie.php(429): CookieCore->encryptAndSetCookie()
#1 classes/Cookie.php(396): CookieCore->write()
#2 [internal function]: CookieCore->__destruct()
#3 {main}

On 29/10/2026, a crawler sent long filtered URLs (~2,300–2,500 characters, no injection payload) to manufacturer pages and produced 875 HTTP 500 responses in about an hour. The same failure also happened on category pages with URLs of about 1,950–2,000 characters.

Root cause

classes/Hook/HookDisplayBeforeBodyClosingTag.php, saveInformationAboutListing() (lines ~244–258):

$this->context->cookie->ga_last_listing = json_encode([
    'item_list_url' => $_SERVER['REQUEST_URI'],
    'item_list_id' => $this->context->controller->php_self,
    'item_list_name' => $listing['label'],
]);

The full raw request URI is stored in the PrestaShop cookie on every product listing page, with no length limit. The cookie is encrypted, which roughly doubles its size, so any listing URL longer than about 1,900 characters makes the cookie exceed 4,096 bytes. CookieCore then throws in __destruct(), after the page has been rendered.

Anyone can trigger this with a long query string. Real customers using filter modules with many selected options can hit it too.

Suggested fix

• Don't store the full REQUEST_URI. Store only the path, or strip the query string, or truncate it (for example to 255 characters). Better still, only keep what HookDisplayFooterProduct really needs (item_list_id / item_list_name).
• Alternatively, skip saving ga_last_listing when the encoded value is too large.

PrestaShop version where the bug happens

9.1.5

Module version where the bug happens

6.0.0 (same code still present on master)

PHP version(s) where the bug happened

8.5

Your company or customer's name goes here (if applicable).

Prestaplugins

Is a fixed version already available or planned? If needed, I can share more log details.