[HttpFoundation] Update "[Session] Overwrite invalid session id" to only validate when files session storage is used

[alexpott]

Q	A
Branch?	4.4
Bug fix?	yes
New feature?	no
Deprecations?	no
Tickets	Fixes #46249
License	MIT
Doc PR	-

#46249 restricts the allowed characters in a session ID. Unfortunately this broke at least two open source projects the use the Symfony component. See nelmio/NelmioSecurityBundle#312 and https://www.drupal.org/project/drupal/issues/3285696

I think the change is not quite correct. It assumes that the valid characters in a session ID is consistent across all session handlers. It is not. See https://www.php.net/manual/en/function.session-id.php it says:

Depending on the session handler, not all characters are allowed within the session id. For example, the file session handler only allows characters in the range a-z A-Z 0-9 , (comma) and - (minus)!

So we've limited the characters to the file session handler but we might not be using that.

[alexpott]

Also I think the original fix is a bit awkward because it results in session data loss - see the fail test runs on https://www.drupal.org/project/drupal/issues/3285696.

It's possible for a session handler to have it's own method for generating IDs - see SessionIdInterface and there are no restrictions about the characters that can return. What is valid is determined by how the session is stored. The a-z A-Z 0-9 , (comma) and - (minus) and length restrictions only exist for PHP's built in file session storage.

[alexpott]

Slightly different approach prompted by @nicolas-grekas - targeting just the NativeFileSessionHandler or if somehow PHP's file session storage is being used.

[nicolas-grekas]

Thank you @alexpott.

[jevrard]

I use native PHP storage and default PHP save handler with configuration like this :

# framework.yml
framework:
    session:
        handler_id: null
        storage_factory_id: session.storage.factory.native

# php.ini
session.save_handler = files

Unfortunately, the getSaveHandlerNameof the SessionHandlerProxy will always return user, so an invalid session ID is not replaced by new one.