[HttpFoundation] Prevent PHP Warning: Session ID is too long or contains illegal characters

Rezyan · nicolas-grekas · commit 84879504db8e · 2022-06-30T17:04:14.000+02:00
diff --git a/src/Symfony/Component/HttpFoundation/Session/Storage/NativeSessionStorage.php b/src/Symfony/Component/HttpFoundation/Session/Storage/NativeSessionStorage.php
@@ -153,7 +153,7 @@ public function start()
         }
 
         $sessionId = $_COOKIE[session_name()] ?? null;
-        if ($sessionId && $this->saveHandler instanceof AbstractProxy && 'files' === $this->saveHandler->getSaveHandlerName() && !preg_match('/^[a-zA-Z0-9,-]{22,}$/', $sessionId)) {
+        if ($sessionId && $this->saveHandler instanceof AbstractProxy && 'files' === $this->saveHandler->getSaveHandlerName() && !preg_match('/^[a-zA-Z0-9,-]{22,250}$/', $sessionId)) {
             // the session ID in the header is invalid, create a new one
             session_id(session_create_id());
         }
diff --git a/src/Symfony/Component/HttpFoundation/Tests/Session/Storage/NativeSessionStorageTest.php b/src/Symfony/Component/HttpFoundation/Tests/Session/Storage/NativeSessionStorageTest.php
@@ -302,7 +302,7 @@ public function testRegenerateInvalidSessionIdForNativeFileSessionHandler()
         $started = $storage->start();
 
         $this->assertTrue($started);
-        $this->assertMatchesRegularExpression('/^[a-zA-Z0-9,-]{22,}$/', session_id());
+        $this->assertMatchesRegularExpression('/^[a-zA-Z0-9,-]{22,250}$/', session_id());
         $storage->save();
 
         $_COOKIE[session_name()] = '&~[';
@@ -311,7 +311,7 @@ public function testRegenerateInvalidSessionIdForNativeFileSessionHandler()
         $started = $storage->start();
 
         $this->assertTrue($started);
-        $this->assertMatchesRegularExpression('/^[a-zA-Z0-9,-]{22,}$/', session_id());
+        $this->assertMatchesRegularExpression('/^[a-zA-Z0-9,-]{22,250}$/', session_id());
         $storage->save();
 
         $_COOKIE[session_name()] = '&~[';

Original file line number	Diff line number	Diff line change
`@@ -153,7 +153,7 @@ public function start()`
`153`	`153`	`}`
`154`	`154`
`155`	`155`	`$sessionId = $_COOKIE[session_name()] ?? null;`
`156`		`- if ($sessionId && $this->saveHandler instanceof AbstractProxy && 'files' === $this->saveHandler->getSaveHandlerName() && !preg_match('/^[a-zA-Z0-9,-]{22,}$/', $sessionId)) {`
	`156`	`+ if ($sessionId && $this->saveHandler instanceof AbstractProxy && 'files' === $this->saveHandler->getSaveHandlerName() && !preg_match('/^[a-zA-Z0-9,-]{22,250}$/', $sessionId)) {`
`157`	`157`	`// the session ID in the header is invalid, create a new one`
`158`	`158`	`session_id(session_create_id());`
`159`	`159`	`}`