Honor use_strict_mode for SessionHandler without validateId

NEWS

@@ -2,6 +2,10 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? ????, PHP 8.4.25
 
+- Session:
+  . Fixed session.use_strict_mode being a no-op for the built-in
+    SessionHandler. (iliaal)
+
 - Date:
   . Fixed leak on double DatePeriod::__construct() call. (ilutov)
 

ext/session/mod_user.c

@@ -270,7 +270,16 @@ PS_VALIDATE_SID_FUNC(user)
 		return ret;
 	}
 
-	/* dummy function defined by PS_MOD */
+	if (PS(default_mod) && PS(default_mod)->s_validate_sid
+			&& PS(default_mod)->s_validate_sid != php_session_validate_sid
+			&& !Z_ISUNDEF(PSF(open)) && Z_TYPE(PSF(open)) == IS_ARRAY) {
+		zval *handler_obj = zend_hash_index_find(Z_ARRVAL(PSF(open)), 0);
+		if (handler_obj && Z_TYPE_P(handler_obj) == IS_OBJECT
+				&& Z_OBJCE_P(handler_obj) == php_session_class_entry) {
+			return PS(default_mod)->s_validate_sid(mod_data, key);
+		}
+	}
+
 	return php_session_validate_sid(mod_data, key);
 }
 

ext/session/tests/session_strict_handler_validate.phpt

@@ -0,0 +1,100 @@
+--TEST--
+use_strict_mode distinguishes SessionHandler from custom-storage subclasses
+--EXTENSIONS--
+session
+--INI--
+session.use_strict_mode=1
+session.use_cookies=0
+session.cache_limiter=
+session.gc_probability=0
+--FILE--
+<?php
+$save_path = sys_get_temp_dir() . '/sess_strict_' . getmypid();
+@mkdir($save_path);
+ini_set('session.save_path', $save_path);
+
+$valid_id = 'validfilesessionid';
+file_put_contents($save_path . '/sess_' . $valid_id, 'value|s:5:"files";');
+
+session_set_save_handler(new SessionHandler, true);
+session_id($valid_id);
+session_start();
+$session_handler_preserved = session_id() === $valid_id;
+$session_handler_loaded = $_SESSION['value'] ?? null;
+session_write_close();
+
+$invalid_id = 'attackerchosensessionidyy' . bin2hex(random_bytes(4));
+session_id($invalid_id);
+session_start();
+$session_handler_adopted = session_id() === $invalid_id;
+session_write_close();
+
+class CustomStorageHandler extends SessionHandler
+{
+    private array $sessions = [
+        'valid-custom-session-id' => 'value|s:6:"loaded";',
+    ];
+
+    public function open(string $path, string $name): bool
+    {
+        return true;
+    }
+
+    public function close(): bool
+    {
+        return true;
+    }
+
+    public function read(string $id): string|false
+    {
+        return $this->sessions[$id] ?? '';
+    }
+
+    public function write(string $id, string $data): bool
+    {
+        $this->sessions[$id] = $data;
+        return true;
+    }
+
+    public function destroy(string $id): bool
+    {
+        unset($this->sessions[$id]);
+        return true;
+    }
+
+    public function gc(int $max_lifetime): int|false
+    {
+        return 0;
+    }
+}
+
+session_set_save_handler(new CustomStorageHandler, true);
+$id = 'valid-custom-session-id';
+session_id($id);
+session_start();
+$custom_handler_preserved = session_id() === $id;
+$custom_handler_loaded = $_SESSION['value'] ?? null;
+session_write_close();
+
+foreach (glob($save_path . '/*') as $f) {
+    @unlink($f);
+}
+@rmdir($save_path);
+
+echo "SessionHandler preserved: ";
+var_dump($session_handler_preserved);
+echo "SessionHandler loaded: ";
+var_dump($session_handler_loaded);
+echo "SessionHandler adopted unknown: ";
+var_dump($session_handler_adopted);
+echo "Custom handler preserved: ";
+var_dump($custom_handler_preserved);
+echo "Custom handler loaded: ";
+var_dump($custom_handler_loaded);
+?>
+--EXPECT--
+SessionHandler preserved: bool(true)
+SessionHandler loaded: string(5) "files"
+SessionHandler adopted unknown: bool(false)
+Custom handler preserved: bool(true)
+Custom handler loaded: string(6) "loaded"