Bug #68063 [NEW]: Empty session IDs do still start sessions

From: mail at thomasbachem dot com Operating system: PHP version: 5.5.17 Package: Session related Bug Type: Bug Bug description:Empty session IDs do still start sessions Description: ------------ If an empty session ID is given to PHP (e.g. a cookie with "PHPSESSID=; path=/" or simply by calling "session_id('')"), session_start() will throw an E_WARNING error from the default session handler ("session_start(): The session id is too long or contains illegal characters, valid characters are a-z, A-Z, 0-9 and '-,'") but still returns true and starts a session. Now session_id() returns '' (the manual states this only happens if there is no current session), but the session was still started, and custom session save handlers are given an empty session ID. If they don't handle that case, a session handler may then actually save session data for an empty session ID. Even the examples from the manual (http://php.net/manual/en/function.session-set-save-handler.php) don't check for an empty session ID. Test script: --------------- <?php // Could also be set with a cookie like "PHPSESSID=; path=/" session_id(''); // Will still start the session and return true var_dump(session_start()); // Returns an empty string var_dump(session_id()); Expected result: ---------------- I would expect session_start() to regenerate a session ID OR to fail, return false and not trigger any session save handlers. Actual result: -------------- Warning: session_start(): The session id is too long or contains illegal characters, valid characters are a-z, A-Z, 0-9 and '-,' in emptysession.php on line 5 boolean true string '' (length=0) Warning: Unknown: The session id is too long or contains illegal characters, valid characters are a-z, A-Z, 0-9 and '-,' in Unknown on line 0 Warning: Unknown: Failed to write session data (files). Please verify that the current setting of session.save_path is correct () in Unknown on line 0 -- Edit bug report at https://bugs.php.net/bug.php?id=68063&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=68063&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=68063&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=68063&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=68063&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=68063&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=68063&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=68063&r=needscript Try newer version: https://bugs.php.net/fix.php?id=68063&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=68063&r=support Expected behavior: https://bugs.php.net/fix.php?id=68063&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=68063&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=68063&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=68063&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=68063&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=68063&r=dst IIS Stability: https://bugs.php.net/fix.php?id=68063&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=68063&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=68063&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=68063&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=68063&r=mysqlcfg