session_regenerate_id with custom handler and use_strict_mode generates three new session ids
- Dominant language
- C
- Stars
- 40.4k
- Forks
- 8.1k
- Avg merge
- 2d 13h
- Merged PRs (30d)
- 96
Description
Description
If I have set session.use_strict_mode = 1 and I have a custom session handler which implements the validateId function, then invoking session_regenerate_id calls
customhandler->create_sid
customhandler->validateId
customhandler->create_sid
customhandler->validateId
customhandler->create_sid
customhandler->validateId
customhandler->create_sid
Looking at the source code for session_regenerate_id, I can see the bug
https://github.com/php/php-src/blob/PHP-8.0.27/ext/session/session.c#L2263
while (limit-- && PS(mod)->s_validate_sid(&PS(mod_data), PS(id)) == SUCCESS) {
Shouldn't this be
while (limit-- && PS(mod)->s_validate_sid(&PS(mod_data), PS(id)) == FAILURE) {
Note that this is the same code in master
PHP Version
PHP 8.0.27
Operating System
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in ext/session/session.c at the session_regenerate_id loop around line 2263, and reproduce the behavior with session.use_strict_mode enabled and a custom handler implementing validateId. Confirm the corrected validation flow and add or update coverage for the reported create_sid and validateId sequence; done means regeneration no longer generates the repeated extra IDs.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c, php
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 25/100