php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #80192 session.use_trans_sid brokes JSON encoded HTML string
Submitted: 2020-10-07 04:21 UTC Modified: 2020-10-07 08:21 UTC
Votes:2
Avg. Score:4.5 ± 0.5
Reproduced:2 of 2 (100.0%)
Same Version:0 (0.0%)
Same OS:2 (100.0%)
From: thebetsuno at gmail dot com Assigned:
Status: Verified Package: Output Control
PHP Version: 7.3 OS: Any
Private report: No CVE-ID: None
View Developer Edit
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: thebetsuno at gmail dot com
New email:
PHP Version: OS:

 

 [2020-10-07 04:21 UTC] thebetsuno at gmail dot com 
Description:
------------
Enabled config parameter "session.use_trans_sid" breaks a JSON encoded HTML string.
Bug is reproducible in versions 5.6.40, 7.2.33 and I believe in other versions.

Test script:
---------------
<?php
ini_set("session.use_cookies", 0);
ini_set("session.use_only_cookies", 0);
ini_set("session.use_trans_sid", 1);
header('Content-Type: application/json');
echo json_encode('<a href="/test">test</a>');

Expected result:
----------------
"<a href=\"\/test?PHPSESSID=7siuuuk98ns2lps0v1v251f1k3\">test<\/a>"

Actual result:
--------------
"<a href=\?PHPSESSID=7siuuuk98ns2lps0v1v251f1k3"\/test\">test<\/a>"

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2020-10-07 08:21 UTC] cmb@php.net
-Status: Open +Status: Verified -Package: Session related +Package: Output Control -PHP Version: 7.2.34 +PHP Version: 7.3
 [2020-10-07 08:21 UTC] cmb@php.net 
Confirmed: <https://3v4l.org/aRVKl>.
 [2023-08-23 11:22 UTC] truongthaietc50 at gmail dot com 
Setting session.use_trans_sid to true in PHP causes the session ID to be automatically added to URLs when encoding HTML content. This can break JSON-encoded HTML strings because the injected session ID disrupts the JSON structure, leading to parsing errors when decoding the JSON on the client side. It's advisable to disable session.use_trans_sid or handle the session ID injection differently to ensure proper JSON decoding and HTML rendering.(https://github.com.php)(https://www.mayoclinicpatientportals.com/)
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved. 		Last updated: Sat Oct 12 06:01:27 2024 UTC