modelcontextprotocol/php-sdk
Watch
1
0
Fork
You've already forked php-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

[Server] Restrict FileSessionStore::gc() to owned session files (#479)

Browse source
This commit is contained in:
Christopher Hertel 2026-08-25 00:43:08 +02:00 • committed by GitHub
commit c36e805086
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 28 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

11
src/Server/Session/FileSessionStore.php
View file

@ -128,6 +128,11 @@ class FileSessionStore implements SessionStoreInterface
continue;
}
// Only delete files this store owns: sessions are named by their RFC 4122 UUID
if (!Uuid::isValid($entry)) {
continue;
}
$path = $this->directory.\DIRECTORY_SEPARATOR.$entry;
if (!is_file($path)) {
continue;
@ -136,11 +141,7 @@ class FileSessionStore implements SessionStoreInterface
$mtime = @filemtime($path) ?: 0;
if (($now - $mtime) > $this->ttl) {
@unlink($path);
try {
$deleted[] = Uuid::fromString($entry);
} catch (\Throwable) {
// ignore non-UUID file names
}
$deleted[] = Uuid::fromString($entry);
}
}

22
tests/Unit/Server/Session/FileSessionStoreTest.php
View file

@ -62,6 +62,28 @@ class FileSessionStoreTest extends TestCase
$this->assertSame('payload', $store->read($id));
}
#[TestDox('gc() only deletes expired session files, never foreign files in the directory')]
public function testGcLeavesForeignFilesAlone(): void
{
$store = new FileSessionStore($this->directory, ttl: 60);
$id = new UuidV4();
$store->write($id, 'payload');
$foreign = $this->directory.'/important.lock';
file_put_contents($foreign, 'not a session');
// Make everything stale
$expired = time() - 120;
touch($this->directory.'/'.$id->toRfc4122(), $expired);
touch($foreign, $expired);
$deleted = $store->gc();
$this->assertEquals([$id], $deleted);
$this->assertFileDoesNotExist($this->directory.'/'.$id->toRfc4122());
$this->assertFileExists($foreign);
}
#[TestDox('rejects an unwritable directory with the SDK\'s own exception')]
public function testUnwritableDirectoryThrowsPackageException(): void
{