harden session parsing/validation and read_file bounds with regressio…

[pavankumar464]

…n tests

[Copilot]

Pull request overview

This PR aims to harden session cookie parsing/validation and improve read_file() robustness, with new regression tests exercising those edge cases.

Changes:

• Add regression tests for read_file() directory input handling and session cookie parsing behaviors.
• Tighten session ID parsing to avoid strtok() mutation and validate prefix/length/charset more strictly.
• Add error handling around fseek()/ftell() in read_file().

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

File	Description
tests/parser_test.cpp	Adds new regression tests for read_file() and session cookie parsing behaviors.
tests/CMakeLists.txt	Links jst_session.c into the test binary so session tests can execute.
source/jst_session.c	Hardens session ID extraction/validation from HTTP_COOKIE and avoids modifying cookie memory.
source/jst_internal.c	Adds error checks for file positioning calls in read_file().

Comments suppressed due to low confidence (1)

source/jst_internal.c:171

• read_file() returns early on failure without initializing *bufout/*lenout. Callers (and the new regression test) rely on these being left as NULL/0, but that currently depends on the caller pre-initializing them. Initialize outputs at the start of the function to make the API safer and deterministic on error paths.

int read_file(const char *filename, char** bufout, size_t* lenout)
{
  FILE* pf;
  size_t size;
  long tell_result;
  size_t rc;
  char* buf;

  CosaPhpExtLog( "read_file %s\n", filename );

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.