Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Appearance settings

Commit 07fa911

Browse filesBrowse files
bug #46678 [HttpFoundation] Update "[Session] Overwrite invalid session id" to only validate when files session storage is used (alexpott)
This PR was submitted for the 6.1 branch but it was squashed and merged into the 4.4 branch instead. Discussion ---------- [HttpFoundation] Update "[Session] Overwrite invalid session id" to only validate when files session storage is used | Q | A | ------------- | --- | Branch? | 4.4 | Bug fix? | yes | New feature? | no | Deprecations? | no | Tickets | Fixes #46249 | License | MIT | Doc PR | - #46249 restricts the allowed characters in a session ID. Unfortunately this broke at least two open source projects the use the Symfony component. See nelmio/NelmioSecurityBundle#312 and https://www.drupal.org/project/drupal/issues/3285696 I think the change is not quite correct. It assumes that the valid characters in a session ID is consistent across all session handlers. It is not. See https://www.php.net/manual/en/function.session-id.php it says: >Depending on the session handler, not all characters are allowed within the session id. For example, the file session handler only allows characters in the range a-z A-Z 0-9 , (comma) and - (minus)! So we've limited the characters to the file session handler but we might not be using that. Commits ------- 12460fa [HttpFoundation] Update "[Session] Overwrite invalid session id" to only validate when files session storage is used
2 parents d686e38 + 12460fa commit 07fa911
Copy full SHA for 07fa911

File tree

2 files changed

+22
-3
lines changed
Filter options

2 files changed

+22
-3
lines changed

‎src/Symfony/Component/HttpFoundation/Session/Storage/NativeSessionStorage.php

Copy file name to clipboardExpand all lines: src/Symfony/Component/HttpFoundation/Session/Storage/NativeSessionStorage.php
+1-1Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -153,7 +153,7 @@ public function start()
153153
}
154154

155155
$sessionId = $_COOKIE[session_name()] ?? null;
156-
if ($sessionId && !preg_match('/^[a-zA-Z0-9,-]{22,}$/', $sessionId)) {
156+
if ($sessionId && $this->saveHandler instanceof AbstractProxy && 'files' === $this->saveHandler->getSaveHandlerName() && !preg_match('/^[a-zA-Z0-9,-]{22,}$/', $sessionId)) {
157157
// the session ID in the header is invalid, create a new one
158158
session_id(session_create_id());
159159
}

‎src/Symfony/Component/HttpFoundation/Tests/Session/Storage/NativeSessionStorageTest.php

Copy file name to clipboardExpand all lines: src/Symfony/Component/HttpFoundation/Tests/Session/Storage/NativeSessionStorageTest.php
+21-2Lines changed: 21 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -294,12 +294,31 @@ public function testGetBagsOnceSessionStartedIsIgnored()
294294
$this->assertEquals($storage->getBag('flashes'), $bag);
295295
}
296296

297-
public function testRegenerateInvalidSessionId()
297+
public function testRegenerateInvalidSessionIdForNativeFileSessionHandler()
298298
{
299299
$_COOKIE[session_name()] = '&~[';
300-
$started = (new NativeSessionStorage())->start();
300+
session_id('&~[');
301+
$storage = new NativeSessionStorage([], new NativeFileSessionHandler());
302+
$started = $storage->start();
301303

302304
$this->assertTrue($started);
303305
$this->assertMatchesRegularExpression('/^[a-zA-Z0-9,-]{22,}$/', session_id());
306+
$storage->save();
307+
308+
$_COOKIE[session_name()] = '&~[';
309+
session_id('&~[');
310+
$storage = new NativeSessionStorage([], new SessionHandlerProxy(new NativeFileSessionHandler()));
311+
$started = $storage->start();
312+
313+
$this->assertTrue($started);
314+
$this->assertMatchesRegularExpression('/^[a-zA-Z0-9,-]{22,}$/', session_id());
315+
$storage->save();
316+
317+
$_COOKIE[session_name()] = '&~[';
318+
session_id('&~[');
319+
$storage = new NativeSessionStorage([], new NullSessionHandler());
320+
$started = $storage->start();
321+
$this->assertTrue($started);
322+
$this->assertSame('&~[', session_id());
304323
}
305324
}

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.