tim/xxx
1
0
Fork 0
Code Issues Pull Requests Releases Activity

Refuse session ids that PHP did not make.

Browse Source
This commit is contained in:
tim
2026-09-26 15:27:51 +02:00
parent 30b275b902
commit ed8918e7fd
3 changed files with 15 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/php/Pages/FrontPagesTest.php
+11
View File
@@ -57,6 +57,17 @@ class FrontPagesTest extends PageTestCase {
$this->assertNull($this->header($this->get('/', array('X-Test-Plain' => '1')), 'Strict-Transport-Security'));
}
// PHP makes a new id for a session id that it did not make, so nobody can plant one
public function testAnUnknownSessionIdIsReplaced(): void {
$planted = str_repeat('ab', 16);
foreach (array('/', '/display?id=1') as $path) {
$this->cookies = array('PHPSESSID' => $planted);
$this->get($path);
$this->assertNotSame($planted, $this->cookies['PHPSESSID'] ?? NULL, $path);
$this->assertFileDoesNotExist(self::$state . "/sessions/sess_$planted", $path);
}
}
public function testPlainHttpStartsNoSession(): void {
$page = $this->get('/', array('X-Test-Plain' => '1'));
$this->assertSame(200, $page['status']);