From d7c98ca1ac10ee0461f332f21e548649dc0e51c9 Mon Sep 17 00:00:00 2001
From: "Christoph M. Becker" <cmbecker69@gmx.de>
Date: Fri, 19 Feb 2021 13:14:26 +0100
Subject: Fix #80774: session_name() problem with backslash

Since we do no longer URL decode cookie names[1], we must not URL
encode the session name.  We need to prevent broken Set-Cookie headers,
by rejecting names which contain invalid characters.

[1] <http://git.php.net/?p=php-src.git;a=commit;h=6559fe912661ca5ce5f0eeeb591d928451428ed0>

Closes GH-6711.
---
 ext/session/tests/bug80774.phpt                | 15 +++++++++++++++
 ext/session/tests/session_name_variation1.phpt |  4 ++++
 2 files changed, 19 insertions(+)
 create mode 100644 ext/session/tests/bug80774.phpt

(limited to 'ext/session/tests')

diff --git a/ext/session/tests/bug80774.phpt b/ext/session/tests/bug80774.phpt
new file mode 100644
index 0000000000..2ce07263f2
--- /dev/null
+++ b/ext/session/tests/bug80774.phpt
@@ -0,0 +1,15 @@
+--TEST--
+Bug #80774 (session_name() problem with backslash)
+--SKIPIF--
+<?php
+if (!extension_loaded('session')) die("skip session extension not available");
+?>
+--FILE--
+<?php
+session_name("foo\\bar");
+session_id('12345');
+session_start();
+?>
+--EXPECTHEADERS--
+Set-Cookie: foo\bar=12345; path=/
+--EXPECT--
diff --git a/ext/session/tests/session_name_variation1.phpt b/ext/session/tests/session_name_variation1.phpt
index 82e5278783..cda7db31a5 100644
--- a/ext/session/tests/session_name_variation1.phpt
+++ b/ext/session/tests/session_name_variation1.phpt
@@ -48,6 +48,8 @@ string(9) "PHPSESSID"
 bool(true)
 string(9) "PHPSESSID"
 string(9) "PHPSESSID"
+
+Warning: session_start(): session.name cannot contain any of the following '=,; \t\r\n\013\014' in %s on line %d
 bool(true)
 string(1) "	"
 bool(true)
@@ -55,6 +57,8 @@ string(1) "	"
 
 Warning: session_name(): session.name cannot be a numeric or empty '' in %s on line %d
 string(1) "	"
+
+Warning: session_start(): session.name cannot contain any of the following '=,; \t\r\n\013\014' in %s on line %d
 bool(true)
 string(1) "	"
 bool(true)
-- 
cgit v1.2.1