modelcontextprotocol/php-sdk
Watch
1
0
Fork
You've already forked php-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

[Server] Restrict FileSessionStore::gc() to owned session files (#479)

Browse source
This commit is contained in:
Christopher Hertel 2026-08-25 00:43:08 +02:00 • committed by GitHub
commit c36e805086
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 28 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

22
tests/Unit/Server/Session/FileSessionStoreTest.php
View file

@ -62,6 +62,28 @@ class FileSessionStoreTest extends TestCase
$this->assertSame('payload', $store->read($id));
}
#[TestDox('gc() only deletes expired session files, never foreign files in the directory')]
public function testGcLeavesForeignFilesAlone(): void
{
$store = new FileSessionStore($this->directory, ttl: 60);
$id = new UuidV4();
$store->write($id, 'payload');
$foreign = $this->directory.'/important.lock';
file_put_contents($foreign, 'not a session');
// Make everything stale
$expired = time() - 120;
touch($this->directory.'/'.$id->toRfc4122(), $expired);
touch($foreign, $expired);
$deleted = $store->gc();
$this->assertEquals([$id], $deleted);
$this->assertFileDoesNotExist($this->directory.'/'.$id->toRfc4122());
$this->assertFileExists($foreign);
}
#[TestDox('rejects an unwritable directory with the SDK\'s own exception')]
public function testUnwritableDirectoryThrowsPackageException(): void
{