Session name with . or [ silently fails instead of giving warning/error #9932

Activity

1. Sjord

   added

   Bug

   Status: Needs Triage

   on Nov 11, 2022
2. devnexen

   added

   Status: Verified

   and removed

   Status: Needs Triage

   on Nov 11, 2022
3. hormus commented on Nov 12, 2022

   

   hormus

   on Nov 12, 2022

   Last edited by hormus

   More actions

   https://www.php.net/manual/en/language.variables.external.php

   For compatibility you must use characters allowed when creating a variable, although using the cookie you must be compatible with the url cookie_name=id_value as well as the valid syntax to create $cookie_name variables

   https://www.php.net/manual/en/function.setcookie.php
   Note: Using separator characters such as [ and ] as part of the cookie name is not compliant to RFC 6265, section 4, but supposed to be supported by user agents according to RFC 6265, section 5.

   the historical reason is register_globals automatically created the variables as not all characters are valid for the variable name we have decided to use
   https://www.php.net/manual/en/language.variables.basics.php As a regular expression, it would be expressed thus: ^[a-zA-Z_\x80-\xff][a-zA-Z0-9_\x80-\xff]*$

   <?php
   
   // $var[ = 'Hello'; //invalid
   // $var. = 'Hello'; //Invalid
   // $var+ = 'Hello' //invalid
   // $var= = 'Hello' //invalid
   // $var& = 'Hello' //invalid
   //$var['b'] = 'Hello' // Valid array $var and first creation of $var
   
   //Variables variable syntax
   ${'var2['} = 'Hello word';
   var_dump(${'var2['}); // Output Hello word and first creation of $var2[ variable
   
   
   // array
   // [ is %5B
   $var['+%5B'] = '/some_path/index.php?a=hello word';
   echo 'https://www.domain.tld' . str_replace(array('%2F', '%2f', '%3F', '%3f', '%3D', '%3d'), array('/', '/', '?', '?', '=', '='), urlencode($var['+%5B']));
   echo "\r\n";
   
   ?>

   previously the first page use $_SESSION['hi'] = 'user'; and this explains the creation of my $t variable

   <?php
   
   ob_end_clean();
   
   $i256 = str_replace(',', '', '115,​792,​089,​237,​316,​195,​423,​570,​985,​008,​687,​907,​853,​269,​984,​665,​640,​564,​039,​457,​584,​007,​913,​129,​639,​936');
   error_reporting((int) $i256);
   $t = true;
   ob_start();
   session_name('a[b]');
   session_start();
   ob_end_clean();
   if(isset($_SESSION['hi'])) {
   $t = false;
   }
   $text = ini_get('session.save_path') . '/sess_' . $_COOKIE['a']['b'];
   
   function get_include_contents($filename) {
       //if (is_file($filename)) {
           ob_start();
           include $filename;
           $var = ob_get_contents();
           ob_end_clean();
           return $var;
       //}
       return false;
   }
   $string = get_include_contents($text);
   $_SESSION['hi'] = 'user2';
   var_dump($string);
   
   ?>

   Expected and actual result:

   string(14) "hi|s:4:"user";"
   

   in this example $t is true means $_SESSION not retrieved but written to the file

   @Sjord although php automatically creates the array of $_COOKIE['a'] (eg $_COOKIE['a']['b']) my example adapted to the code proposed above session_start(['name' => 'a[b']) and $_COOKIE['a_b'] retrieves the value directly from the file
4. cmb69

   added

   Extension: session

   on Nov 15, 2022
5. devnexen

   closed this as completedin a4298c1on Nov 15, 2022
6. TimWolla

   added a commit that references this issue on Nov 15, 2022

   Merge branch 'master' into unserialize-notice-to-warning

   ...

   This issue will close once commit 6fa26b1 is merged into the 'master' branch.

   6fa26b1
7. bukka

   added a commit that references this issue on Mar 29, 2024

   Fix phpGH-9932: Discards further characters for session name.

   ...

   This issue will close once commit a4298c1 is merged into the 'master' branch.

   a4298c1