[HttpFoundation] PHP Warning: SessionHandler::read(): Session ID is too long or contains illegal characters.
#46777
Comments
SessionHandler::read(): Session ID is too long or contains illegal characters.SessionHandler::read(): Session ID is too long or contains illegal characters.
|
Would you like to send a PR with your suggested solution? |
nicolas-grekas
added a commit
that referenced
this issue
Jun 30, 2022
…ng or contains illegal characters (BrokenSourceCode) This PR was squashed before being merged into the 4.4 branch. Discussion ---------- [HttpFoundation] Prevent PHP Warning: Session ID is too long or contains illegal characters | Q | A | ------------- | --- | Branch? |4.4 | Bug fix? | yes | New feature? | no | Deprecations? | no | Tickets | Fix #46777 | License | MIT This PR is intended to improve the changes made in the PR #46249 that doesn't check the max length of the session ID. To do this, I used the PHP ini directives below: - [`session.sid_length`](https://www.php.net/manual/en/session.configuration.php#ini.session.sid-length) (must be an integer between `22` and `256`) - [`session.sid_bits_per_character`](https://www.php.net/manual/en/session.configuration.php#ini.session.sid-bits-per-character) (must be an integer such as `4`, `5` or `6`) Commits ------- 8487950 [HttpFoundation] Prevent PHP Warning: Session ID is too long or contains illegal characters
fabpot
added a commit
that referenced
this issue
Jul 8, 2022
…rceCode) This PR was squashed before being merged into the 4.4 branch. Discussion ---------- [HttpFoundation] Add session ID regex comment | Q | A | ------------- | --- | Branch? | 4.4 | Bug fix? | no | New feature? | no | Deprecations? | no | License | MIT A comment intended to explain the session ID regular expression. Related links: - #46777 - #46790 Commits ------- 4908090 [HttpFoundation] Add session ID regex comment
symfony-splitter
pushed a commit
to symfony/http-foundation
that referenced
this issue
Jul 8, 2022
…rceCode) This PR was squashed before being merged into the 4.4 branch. Discussion ---------- [HttpFoundation] Add session ID regex comment | Q | A | ------------- | --- | Branch? | 4.4 | Bug fix? | no | New feature? | no | Deprecations? | no | License | MIT A comment intended to explain the session ID regular expression. Related links: - symfony/symfony#46777 - symfony/symfony#46790 Commits ------- 49080903d2 [HttpFoundation] Add session ID regex comment
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Symfony version(s) affected
6.1.0
Description
Hi,
When I cheat on the front-end and manually change the session cookie length with the dev console, this emits a warning on the back-end:
Therefore, malicious users can generate warning messages.
How to reproduce
You just need to manually change the session cookie in the front-end and put more than 256 characters.
Possible Solution
I guess that the regular expression on this line should check the max length too:
symfony/src/Symfony/Component/HttpFoundation/Session/Storage/NativeSessionStorage.php
Line 139 in 6597825
Maybe like this:
'/^[a-zA-Z0-9,-]{22,256}$/'. According to the PHP doc :Additional Context
Related PR: #46249.
No response
The text was updated successfully, but these errors were encountered: