Added ValueError and reverted other changes

Author: jorgsowa

ext/session/mod_files.c

@@ -166,6 +166,7 @@ static void ps_files_open(ps_files *data, /* const */ zend_string *key)
 		ps_files_close(data);
 
 		if (php_session_valid_key(ZSTR_VAL(key)) == FAILURE) {
+			php_error_docref(NULL, E_WARNING, "Session ID is too long or contains illegal characters. Only the A-Z, a-z, 0-9, \"-\", and \",\" characters are allowed");
 			return;
 		}
 

ext/session/session.c

@@ -368,7 +368,6 @@ PHPAPI zend_result php_session_valid_key(const char *key) /* {{{ */
 				|| (c >= '0' && c <= '9')
 				|| c == ','
 				|| c == '-')) {
-			php_error_docref(NULL, E_WARNING, "Prefix or name cannot contain special characters. Only the A-Z, a-z, 0-9, \"-\", and \",\" characters are allowed");
 			return FAILURE;
 		}
 	}
@@ -378,7 +377,6 @@ PHPAPI zend_result php_session_valid_key(const char *key) /* {{{ */
 	/* Somewhat arbitrary length limit here, but should be way more than
 	   anyone needs and avoids file-level warnings later on if we exceed MAX_PATH */
 	if (len == 0 || len > PS_MAX_SID_LENGTH) {
-		php_error_docref(NULL, E_WARNING, "Prefix or name cannot be larger than 256 characters");
 		return FAILURE;
 	}
 
@@ -2385,8 +2383,13 @@ PHP_FUNCTION(session_create_id)
 	}
 
 	if (prefix && ZSTR_LEN(prefix)) {
+        if (ZSTR_LEN(prefix) > PS_MAX_SID_LENGTH) {
+            zend_argument_value_error(1, "cannot be longer than %d characters", PS_MAX_SID_LENGTH);
+            RETURN_THROWS();
+        }
 		if (php_session_valid_key(ZSTR_VAL(prefix)) == FAILURE) {
 			/* E_ERROR raised for security reason. */
+			php_error_docref(NULL, E_WARNING, "Prefix cannot contain special characters. Only the A-Z, a-z, 0-9, \"-\", and \",\" characters are allowed");
 			RETURN_FALSE;
 		} else {
 			smart_str_append(&id, prefix);

ext/session/tests/rfc1867_sid_invalid.post

@@ -0,0 +1,13 @@
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="PHP_SESSION_UPLOAD_PROGRESS"
+
+rfc1867_sid_invalid.php
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="file1"; filename="file1.txt"
+
+1
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="file2"; filename="file2.txt"
+
+2
+-----------------------------20896060251896012921717172737--

ext/session/tests/session_create_id_invalid_prefix.phpt

@@ -12,23 +12,20 @@ session
 
 var_dump(session_create_id('_'));
 var_dump(session_create_id('%'));
-var_dump(session_create_id('ABTgdPs68S3M4HMaqKwj33TzqLMv5PHpWQxJbfpeogEhrJRY7o9f33pKLCmhf0tXCtoBkIu0yxXYCSHfJhPd2miPUW4MIpd91dnEiOwWDfaBnfdJZOwgvgmYLSfDGaebqmnCAoyuzlcq2j59nNRhccgJIkr9ytY3RwFTTXszpcjpx6mlJuG9GksKAhPsnnaEwSEb0eFyqvn80gYI2roKSjaFSmJxg0xgXuCF4csMo8DxiSvovho5QTKx5u7h8VyQL'));
 try {
+    var_dump(session_create_id('ABTgdPs68S3M4HMaqKwj33TzqLMv5PHpWQxJbfpeogEhrJRY7o9f33pKLCmhf0tXCtoBkIu0yxXYCSHfJhPd2miPUW4MIpd91dnEiOwWDfaBnfdJZOwgvgmYLSfDGaebqmnCAoyuzlcq2j59nNRhccgJIkr9ytY3RwFTTXszpcjpx6mlJuG9GksKAhPsnnaEwSEb0eFyqvn80gYI2roKSjaFSmJxg0xgXuCF4csMo8DxiSvovho5QTKx5u7h8VyQL'));
     var_dump(session_create_id("AB\0CD"));
 } catch (Throwable $e) {
-    echo $e->getMessage() . "\n";
+    echo $e::class . ': ' . $e->getMessage() . "\n";
 }
 
 ?>
 Done
 --EXPECTF--
-Warning: session_create_id(): Prefix or name cannot contain special characters. Only the A-Z, a-z, 0-9, "-", and "," characters are allowed in %s on line %d
+Warning: session_create_id(): Prefix cannot contain special characters. Only the A-Z, a-z, 0-9, "-", and "," characters are allowed in %s on line %d
 bool(false)
 
-Warning: session_create_id(): Prefix or name cannot contain special characters. Only the A-Z, a-z, 0-9, "-", and "," characters are allowed in %s on line %d
+Warning: session_create_id(): Prefix cannot contain special characters. Only the A-Z, a-z, 0-9, "-", and "," characters are allowed in %s on line %d
 bool(false)
-
-Warning: session_create_id(): Prefix or name cannot be larger than 256 characters in %s on line %d
-bool(false)
-session_create_id(): Argument #1 ($prefix) must not contain any null bytes
+ValueError: session_create_id(): Argument #1 ($prefix) cannot be longer than 256 characters
 Done