modelcontextprotocol/php-sdk
Watch
1
0
Fork
You've already forked php-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

[Server] Restrict FileSessionStore::gc() to owned session files (#479)

Browse source
This commit is contained in:
Christopher Hertel 2026-08-25 00:43:08 +02:00 • committed by GitHub
commit c36e805086
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 28 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

11
src/Server/Session/FileSessionStore.php
View file

@ -128,6 +128,11 @@ class FileSessionStore implements SessionStoreInterface
continue;
}
// Only delete files this store owns: sessions are named by their RFC 4122 UUID
if (!Uuid::isValid($entry)) {
continue;
}
$path = $this->directory.\DIRECTORY_SEPARATOR.$entry;
if (!is_file($path)) {
continue;
@ -136,11 +141,7 @@ class FileSessionStore implements SessionStoreInterface
$mtime = @filemtime($path) ?: 0;
if (($now - $mtime) > $this->ttl) {
@unlink($path);
try {
$deleted[] = Uuid::fromString($entry);
} catch (\Throwable) {
// ignore non-UUID file names
}
$deleted[] = Uuid::fromString($entry);
}
}