Skip to content

test: add missing test cases for PHP session file upload detection#4415

Merged
fzipi merged 2 commits into
feat/lfi-php-session-filefrom
copilot/sub-pr-4412
Jan 19, 2026
Merged

test: add missing test cases for PHP session file upload detection#4415
fzipi merged 2 commits into
feat/lfi-php-session-filefrom
copilot/sub-pr-4412

Conversation

Copy link
Copy Markdown
Contributor

Copilot AI commented Jan 19, 2026

Proposed changes

Adds missing test coverage for rule 933220 (PHP session file upload detection) based on code review feedback. The existing rule supports 6-bit encoded session IDs (includes commas) and applies lowercase transformation, but lacked tests validating these behaviors.

Added test cases:

  • Session IDs with commas (sess_abc123,def456,ghi789jkl) — validates 6-bit character set support
  • Uppercase characters in session ID (sess_ABC123def456ghi789jkl) — validates t:lowercase transformation
  • Uppercase prefix (SESS_abc123def456ghi789jkl) — validates prefix transformation

Partially addresses #4332

PR Checklist

  • I have read the CONTRIBUTING doc
  • I have added positive tests proving my fix/feature works as intended.
  • I have added negative tests that prove my fix/feature considers common cases that might end in false positives
  • In case you changed a regular expression, you are not adding a ReDOS for pcre. You can check this using regexploit
  • My test use the comment field to write the expected behavior
  • I have added documentation for the rule or change (when appropriate)

Further comments

No rule changes — test-only additions. All new tests validated against existing regex pattern (?:^|[/\x5c])sess_[,\-0-9a-z]{20,256}$.

For the reviewer

  • Positive and negative tests were added
  • Tests cover the intended fix/feature properly
  • No usage of dangerous constructs like ctl:requestBodyAccess=Off were used in the rule
  • In case a regular expression was changed, there is no ReDOS
  • Documentation is clear for the rule/change

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

Co-authored-by: fzipi <3012076+fzipi@users.noreply.github.com>
Copilot AI changed the title [WIP] Add protection against PHP session file upload attacks test: add missing test cases for PHP session file upload detection Jan 19, 2026
Copilot AI requested a review from fzipi January 19, 2026 18:17
@fzipi fzipi marked this pull request as ready for review January 19, 2026 19:36
@fzipi fzipi merged commit 4b4ac99 into feat/lfi-php-session-file Jan 19, 2026
7 checks passed
@fzipi fzipi deleted the copilot/sub-pr-4412 branch January 19, 2026 19:36
github-merge-queue Bot pushed a commit that referenced this pull request Jan 23, 2026
* feat: prevent php session files to be uploaded

Signed-off-by: Felipe Zipitria <felipe.zipitria@owasp.org>

* Apply suggestions from code review

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Apply suggestion from @fzipi

* test: add missing test cases for PHP session file upload detection (#4415)

* Initial plan

* Add test cases for comma and uppercase handling

Co-authored-by: fzipi <3012076+fzipi@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: fzipi <3012076+fzipi@users.noreply.github.com>

* fix: nginx overrides

Signed-off-by: Felipe Zipitria <felipe.zipitria@owasp.org>

* fix: move to pl1

Signed-off-by: Felipe Zipitria <felipe.zipitria@owasp.org>

---------

Signed-off-by: Felipe Zipitria <felipe.zipitria@owasp.org>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants