From 12460fa0819c4b71c63148dd6a62466b1387c799 Mon Sep 17 00:00:00 2001 From: Alex Pott Date: Wed, 15 Jun 2022 09:12:29 +0100 Subject: [PATCH] [HttpFoundation] Update "[Session] Overwrite invalid session id" to only validate when files session storage is used --- .../Session/Storage/NativeSessionStorage.php | 2 +- .../Storage/NativeSessionStorageTest.php | 23 +++++++++++++++++-- 2 files changed, 22 insertions(+), 3 deletions(-) diff --git a/src/Symfony/Component/HttpFoundation/Session/Storage/NativeSessionStorage.php b/src/Symfony/Component/HttpFoundation/Session/Storage/NativeSessionStorage.php index 76ebfa08a482d..4caba27dbc2df 100644 --- a/src/Symfony/Component/HttpFoundation/Session/Storage/NativeSessionStorage.php +++ b/src/Symfony/Component/HttpFoundation/Session/Storage/NativeSessionStorage.php @@ -153,7 +153,7 @@ public function start() } $sessionId = $_COOKIE[session_name()] ?? null; - if ($sessionId && !preg_match('/^[a-zA-Z0-9,-]{22,}$/', $sessionId)) { + if ($sessionId && $this->saveHandler instanceof AbstractProxy && 'files' === $this->saveHandler->getSaveHandlerName() && !preg_match('/^[a-zA-Z0-9,-]{22,}$/', $sessionId)) { // the session ID in the header is invalid, create a new one session_id(session_create_id()); } diff --git a/src/Symfony/Component/HttpFoundation/Tests/Session/Storage/NativeSessionStorageTest.php b/src/Symfony/Component/HttpFoundation/Tests/Session/Storage/NativeSessionStorageTest.php index 776da2adc27f1..86b4dd505567b 100644 --- a/src/Symfony/Component/HttpFoundation/Tests/Session/Storage/NativeSessionStorageTest.php +++ b/src/Symfony/Component/HttpFoundation/Tests/Session/Storage/NativeSessionStorageTest.php @@ -294,12 +294,31 @@ public function testGetBagsOnceSessionStartedIsIgnored() $this->assertEquals($storage->getBag('flashes'), $bag); } - public function testRegenerateInvalidSessionId() + public function testRegenerateInvalidSessionIdForNativeFileSessionHandler() { $_COOKIE[session_name()] = '&~['; - $started = (new NativeSessionStorage())->start(); + session_id('&~['); + $storage = new NativeSessionStorage([], new NativeFileSessionHandler()); + $started = $storage->start(); $this->assertTrue($started); $this->assertMatchesRegularExpression('/^[a-zA-Z0-9,-]{22,}$/', session_id()); + $storage->save(); + + $_COOKIE[session_name()] = '&~['; + session_id('&~['); + $storage = new NativeSessionStorage([], new SessionHandlerProxy(new NativeFileSessionHandler())); + $started = $storage->start(); + + $this->assertTrue($started); + $this->assertMatchesRegularExpression('/^[a-zA-Z0-9,-]{22,}$/', session_id()); + $storage->save(); + + $_COOKIE[session_name()] = '&~['; + session_id('&~['); + $storage = new NativeSessionStorage([], new NullSessionHandler()); + $started = $storage->start(); + $this->assertTrue($started); + $this->assertSame('&~[', session_id()); } }