Bug #68970 [Asn]: output_add_rewrite_var() add session ID path begins with "//"

Edit report at https://bugs.php.net/bug.php?id=68970&edit=1 ID: 68970 Updated by: yohgaki@php.net Reported by: yohgaki@php.net Summary: output_add_rewrite_var() add session ID path begins with "//" Status: Assigned Type: Bug Package: Output Control Operating System: any PHP Version: master-Git-2015-02-02 (Git) Assigned To: mike Block user comment: N Private report: N New Comment: I've committed the test script to master. https://github.com/php/php-src/blob/master/ext/session/tests/session_basic3.phpt This bug is security related when trans sid is enabled. Previous Comments: ------------------------------------------------------------------------ [2015-02-02 08:37:47] mike@php.net Ugh, I've no idea about re2c. I surely didn't touch this more then necessary, I even didn't convert the output handler from a compat-style to a new-style one, i.e. moving global state to a handler context :-/ ------------------------------------------------------------------------ [2015-02-02 06:28:02] yohgaki@php.net My initial bug report was bogus. I changed the bug title. output_add_rewrite_var() should not add session ID for anything look like full path including "//". i.e. If output_add_rewrite_var() adds session ID to other sites, it means session module is leaking session ID to other sites. Trans SID must work only for originating site. ------------------------------------------------------------------------ [2015-02-02 03:15:02] yohgaki@php.net Latest test script can be found here. https://github.com/yohgaki/php-src/blob/master-cleanup-trans-sid/ext/session/tests/session_basic3.phpt ------------------------------------------------------------------------ [2015-02-02 02:46:43] yohgaki@php.net Mike, could you take care url_scanner_ex.re issue? I think output control does this since your new output API. (I really like your new output API, BTW) There may be issues in session module also. I'll take care session module issue. ------------------------------------------------------------------------ [2015-02-02 02:42:05] yohgaki@php.net Description: ------------ It seems url_scanner_ex.re has some problems. It fails to handle some urls. I'm trying to check if session.use_trans_sid=1 works or not. Test script: --------------- --TEST-- Test basic function : variation3 use_trans_sid --INI-- session.use_strict_mode=0 session.use_only_cookies=0 session.use_trans_sid=1 session.save_handler=files session.hash_bits_per_character=4 session.hash_function=0 session.gc_probability=1 session.gc_divisor=1000 session.gc_maxlifetime=300 session.save_path= session.name=PHPSESSID --SKIPIF-- <?php include('skipif.inc'); ?> --FILE-- <?php ob_start(); /* * Prototype : session.use_trans_sid=1 * Description : Test basic functionality. * Source code : ext/session/session.c */ echo "*** Testing basic session functionality : variation3 use_trans_sid ***\n"; echo "*** test output_add_rewrite_var() ***\n"; output_add_rewrite_var('var', 'value'); echo ' <a href="/">test</a> <a href="/#bar">test</a> <a href="/?foo">test</a> <a href="/?foo#bar">test</a> <a href="/?foo=var">test</a> <a href="/?foo=var#bar">test</a> <a href="file.php">test</a> <a href="file.php?foo">test</a> <a href="file.php?foo=var">test</a> <a href="http://php.net">test</a> <a href="http://php.net/">test</a> <a href="http://php.net/#bar">test</a> <a href="http://php.net/?foo">test</a> <a href="http://php.net/?foo#bar">test</a> <a href="http://php.net/?foo=var">test</a> <a href="http://php.net/?foo=var#bar">test</a> <a href="http://php.net/file.php">test</a> <a href="http://php.net/file.php#bar">test</a> <a href="http://php.net/file.php?foo">test</a> <a href="http://php.net/file.php?foo#bar">test</a> <a href="http://php.net/file.php?foo=var">test</a> <a href="http://php.net/file.php?foo=var#bar">test</a> <a href="http://php.net/some/path/file.php">test</a> <a href="http://php.net/some/path/file.php?foo">test</a> <a href="http://php.net/some/path/file.php?foo=var">test</a> <a href="http://php.net/some/path/file.php?foo=var#bar">test</a> <a href="https://php.net">test</a> <a href="https://php.net/">test</a> <a href="https://php.net/?foo=var#bar">test</a> <a href="https://php.net/file.php">test</a> <a href="https://php.net/file.php?foo=var#bar">test</a> <a href="https://php.net/some/path/file.php">test</a> <a href="https://php.net/some/path/file.php?foo=var#bar">test</a> <a href="//php.net">test</a> <a href="//php.net/">test</a> <a href="//php.net/#bar">test</a> <a href="//php.net/?foo">test</a> <a href="//php.net/?foo#bar">test</a> <a href="//php.net/?foo=var">test</a> <a href="//php.net/?foo=var#bar">test</a> <a href="//php.net/file.php">test</a> <a href="//php.net/file.php#bar">test</a> <a href="//php.net/file.php?foo">test</a> <a href="//php.net/file.php?foo#bar">test</a> <a href="//php.net/file.php?foo=var">test</a> <a href="//php.net/file.php?foo=var#bar">test</a> <a href="//php.net/some/path/file.php">test</a> <a href="//php.net/some/path/file.php?foo">test</a> <a href="//php.net/some/path/file.php?foo=var">test</a> <a href="//php.net/some/path/file.php?foo=var#bar">test</a> <form action="script.php" method="post"> <input type="text" name="test1"></input> <input type="text" name="test2" /> </form> '; output_reset_rewrite_vars(); echo "*** Test trans sid ***\n"; ob_start(); $session_id = 'testid'; session_id($session_id); echo ' <a href="file.php">test</a> <a href="http://php.net">test</a> <a href="http://php.net/">test</a> <a href="http://php.net/file.php">test</a> <form action="script.php" method="post"> <input type="text" name="testa" /> <input type="text" name="testb" /> </form> '; echo "*** Cleanup ***\n"; var_dump(session_id($session_id)); var_dump(session_start()); var_dump(session_destroy()); ob_end_flush(); ?> --EXPECTF-- Actual result: -------------- I get following output from output_add_rewrite_var(). <a href="/?PHPSESSID=testid">test</a> <a href="/?PHPSESSID=testid#bar">test</a> <a href="/?foo&PHPSESSID=testid">test</a> <a href="/?foo&PHPSESSID=testid#bar">test</a> <a href="/?foo=var&PHPSESSID=testid">test</a> <a href="/?foo=var&PHPSESSID=testid#bar">test</a> <a href="file.php?PHPSESSID=testid">test</a> <a href="file.php?foo&PHPSESSID=testid">test</a> <a href="file.php?foo=var&PHPSESSID=testid">test</a> <a href="http://php.net">test</a> <a href="http://php.net/">test</a> <a href="http://php.net/#bar">test</a> <a href="http://php.net/?foo">test</a> <a href="http://php.net/?foo#bar">test</a> <a href="http://php.net/?foo=var">test</a> <a href="http://php.net/?foo=var#bar">test</a> <a href="http://php.net/file.php">test</a> <a href="http://php.net/file.php#bar">test</a> <a href="http://php.net/file.php?foo">test</a> <a href="http://php.net/file.php?foo#bar">test</a> <a href="http://php.net/file.php?foo=var">test</a> <a href="http://php.net/file.php?foo=var#bar">test</a> <a href="http://php.net/some/path/file.php">test</a> <a href="http://php.net/some/path/file.php?foo">test</a> <a href="http://php.net/some/path/file.php?foo=var">test</a> <a href="http://php.net/some/path/file.php?foo=var#bar">test</a> <a href="https://php.net">test</a> <a href="https://php.net/">test</a> <a href="https://php.net/?foo=var#bar">test</a> <a href="https://php.net/file.php">test</a> <a href="https://php.net/file.php?foo=var#bar">test</a> <a href="https://php.net/some/path/file.php">test</a> <a href="https://php.net/some/path/file.php?foo=var#bar">test</a> <a href="//php.net?PHPSESSID=testid">test</a> <a href="//php.net/?PHPSESSID=testid">test</a> <a href="//php.net/?PHPSESSID=testid#bar">test</a> <a href="//php.net/?foo&PHPSESSID=testid">test</a> <a href="//php.net/?foo&PHPSESSID=testid#bar">test</a> <a href="//php.net/?foo=var&PHPSESSID=testid">test</a> <a href="//php.net/?foo=var&PHPSESSID=testid#bar">test</a> <a href="//php.net/file.php?PHPSESSID=testid">test</a> <a href="//php.net/file.php?PHPSESSID=testid#bar">test</a> <a href="//php.net/file.php?foo&PHPSESSID=testid">test</a> <a href="//php.net/file.php?foo&PHPSESSID=testid#bar">test</a> <a href="//php.net/file.php?foo=var&PHPSESSID=testid">test</a> <a href="//php.net/file.php?foo=var&PHPSESSID=testid#bar">test</a> <a href="//php.net/some/path/file.php?PHPSESSID=testid">test</a> <a href="//php.net/some/path/file.php?foo&PHPSESSID=testid">test</a> <a href="//php.net/some/path/file.php?foo=var&PHPSESSID=testid">test</a> <a href="//php.net/some/path/file.php?foo=var&PHPSESSID=testid#bar">test</a> <form action="script.php" method="post"><input type="hidden" name="PHPSESSID" value="testid" /> <input type="text" name="test1"></input> <input type="text" name="test2" /> </form> ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=68970&edit=1