Bug #68970 [Asn]: output_add_rewrite_var() add session ID path begins with "//"

Edit report at https://bugs.php.net/bug.php?id=68970&edit=1 ID: 68970 Updated by: yohgaki@php.net Reported by: yohgaki@php.net Summary: output_add_rewrite_var() add session ID path begins with "//" Status: Assigned Type: Bug Package: Output Control Operating System: any PHP Version: master-Git-2015-02-02 (Git) -Assigned To: mike +Assigned To: yohgaki Block user comment: N Private report: N New Comment: Assigned to me. Feel free to fix it anyone! I don't have much time for this... Previous Comments: ------------------------------------------------------------------------ [2015-02-02 09:05:28] yohgaki@php.net I've committed the test script to master. https://github.com/php/php-src/blob/master/ext/session/tests/session_basic3.phpt This bug is security related when trans sid is enabled. ------------------------------------------------------------------------ [2015-02-02 08:37:47] mike@php.net Ugh, I've no idea about re2c. I surely didn't touch this more then necessary, I even didn't convert the output handler from a compat-style to a new-style one, i.e. moving global state to a handler context :-/ ------------------------------------------------------------------------ [2015-02-02 06:28:02] yohgaki@php.net My initial bug report was bogus. I changed the bug title. output_add_rewrite_var() should not add session ID for anything look like full path including "//". i.e. If output_add_rewrite_var() adds session ID to other sites, it means session module is leaking session ID to other sites. Trans SID must work only for originating site. ------------------------------------------------------------------------ [2015-02-02 03:15:02] yohgaki@php.net Latest test script can be found here. https://github.com/yohgaki/php-src/blob/master-cleanup-trans-sid/ext/session/tests/session_basic3.phpt ------------------------------------------------------------------------ [2015-02-02 02:46:43] yohgaki@php.net Mike, could you take care url_scanner_ex.re issue? I think output control does this since your new output API. (I really like your new output API, BTW) There may be issues in session module also. I'll take care session module issue. ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=68970 -- Edit this bug report at https://bugs.php.net/bug.php?id=68970&edit=1