Remove all malformed cookies in middleware

public/typo3conf/ext/ep_products/Classes/Utility/BookingUrlUtility.php

@@ -66,8 +66,9 @@ class BookingUrlUtility
         $bpnCookie = null;
 
         if (isset($_COOKIE[static::COOKIE_NAME])) {
-            if (false === preg_match('/([a-z]{4}|PA)\d{4}/', $_COOKIE[static::COOKIE_NAME])) {
+            if (!preg_match('/^([a-z]{4}|PA)\d{4}$/', $_COOKIE[static::COOKIE_NAME])) {
                 setcookie(static::COOKIE_NAME, '', time() - 3600);
+                unset($_COOKIE[static::COOKIE_NAME]);
             } else {
                 $trackingCookie = $_COOKIE[static::COOKIE_NAME];
             }

public/typo3conf/ext/ep_track/Classes/Middleware/TrackingMiddleware.php

@@ -54,6 +54,8 @@ class TrackingMiddleware implements MiddlewareInterface
 
     public function process(ServerRequestInterface $request, RequestHandlerInterface $handler): ResponseInterface
     {
+        $this->cleanupCookies();
+
         if ($redirect = $this->matchRedirect($request)) {
             [$uri, $responseCode] = $redirect;
 
@@ -165,6 +167,18 @@ class TrackingMiddleware implements MiddlewareInterface
         setcookie(static::COOKIE_NAME, $code, $expiratonDate->getTimestamp(), '/');
     }
 
+    protected function cleanupCookies(): void
+    {
+        if (!isset($_COOKIE[static::COOKIE_NAME])) {
+            return;
+        }
+
+        if (!preg_match('/^' . static::CODE_PATTERN . '$/', $_COOKIE[static::COOKIE_NAME])) {
+            setcookie(static::COOKIE_NAME, '', time() - 3600);
+            unset($_COOKIE[static::COOKIE_NAME]);
+        }
+    }
+
     /**
      * Borrowed from \TYPO3\CMS\Redirects\Service\RedirectService
      *