archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-15 13:38:49 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

ext/session: session_create_id() now throws a ValueError for large prefix (#15338)

Browse source
This commit is contained in:
Jorg Adam Sowa 2024-08-15 12:10:18 +02:00 • committed by GitHub
parent 794ba29a57
commit 21fa5e15f9
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 18 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

4
ext/session/session.c
View file

@ -2383,6 +2383,10 @@ PHP_FUNCTION(session_create_id)
} }
if (prefix && ZSTR_LEN(prefix)) { if (prefix && ZSTR_LEN(prefix)) {
if (ZSTR_LEN(prefix) > PS_MAX_SID_LENGTH) {
zend_argument_value_error(1, "cannot be longer than %d characters", PS_MAX_SID_LENGTH);
RETURN_THROWS();
}
if (php_session_valid_key(ZSTR_VAL(prefix)) == FAILURE) { if (php_session_valid_key(ZSTR_VAL(prefix)) == FAILURE) {
/* E_ERROR raised for security reason. */ /* E_ERROR raised for security reason. */
php_error_docref(NULL, E_WARNING, "Prefix cannot contain special characters. Only the A-Z, a-z, 0-9, \"-\", and \",\" characters are allowed"); php_error_docref(NULL, E_WARNING, "Prefix cannot contain special characters. Only the A-Z, a-z, 0-9, \"-\", and \",\" characters are allowed");

21
ext/session/tests/session_create_id_invalid_prefix.phpt
View file

@ -12,8 +12,18 @@ session
var_dump(session_create_id('_')); var_dump(session_create_id('_'));
var_dump(session_create_id('%')); var_dump(session_create_id('%'));
var_dump(session_create_id("AB\0CD"));
try {
var_dump(session_create_id('ABTgdPs68S3M4HMaqKwj33TzqLMv5PHpWQxJbfpeogEhrJRY7o9f33pKLCmhf0tXCtoBkIu0yxXYCSHfJhPd2miPUW4MIpd91dnEiOwWDfaBnfdJZOwgvgmYLSfDGaebqmnCAoyuzlcq2j59nNRhccgJIkr9ytY3RwFTTXszpcjpx6mlJuG9GksKAhPsnnaEwSEb0eFyqvn80gYI2roKSjaFSmJxg0xgXuCF4csMo8DxiSvovho5QTKx5u7h8VyQL'));
} catch (Throwable $e) {
echo $e::class . ': ' . $e->getMessage() . "\n";
}
try {
var_dump(session_create_id("AB\0CD"));
} catch (Throwable $e) {
echo $e::class . ': ' . $e->getMessage() . "\n";
}
?> ?>
Done Done
@ -23,9 +33,6 @@ bool(false)
Warning: session_create_id(): Prefix cannot contain special characters. Only the A-Z, a-z, 0-9, "-", and "," characters are allowed in %s on line %d Warning: session_create_id(): Prefix cannot contain special characters. Only the A-Z, a-z, 0-9, "-", and "," characters are allowed in %s on line %d
bool(false) bool(false)
ValueError: session_create_id(): Argument #1 ($prefix) cannot be longer than 256 characters
Fatal error: Uncaught ValueError: session_create_id(): Argument #1 ($prefix) must not contain any null bytes in %s:%d ValueError: session_create_id(): Argument #1 ($prefix) must not contain any null bytes
Stack trace: Done
#0 %s(5): session_create_id('AB\x00CD')
#1 {main}
thrown in %s