fix: resolve TOCTOU symlink vulnerability in FileHandler gc and destroy

[gr8man]

Description
This PR fixes a Time-of-Check to Time-of-Use (TOCTOU) vulnerability within the FileHandler session driver.

Previously, gc() and destroy() relied on is_file() and filemtime(), which automatically follow symbolic links. In a shared hosting environment with a predictable or shared session save path (like /tmp), an attacker could potentially replace their session file with a symlink pointing to another system file. By racing the garbage collector, they could use the unlink() operation as an oracle to infer the modification time (mtime) of arbitrary files on the system, depending on whether their symlink was deleted or not. It also resolves false-positives raised by strict security scanners regarding the lack of is_link checks before unlink.

Changes:

• Switched to using lstat() in FileHandler::gc() to retrieve file stats without following symbolic links.
• Added strict is_link() checks before any @unlink() calls in both gc() and destroy() to ensure the handler explicitly ignores symlinks.
• Implemented FileHandlerTest.php to thoroughly verify that symbolic links are appropriately ignored by the garbage collector and the destruction routine.

Checklist:

• Secure against symlink race conditions (TOCTOU).
• Covered by unit tests (tests/system/Session/Handlers/FileHandlerTest.php).
• Passes PHPStan static analysis and Coding Standards fixers.

[michalsn]

Rebase went wrong, and PR has commits that were already merged.

[michalsn]

This PR fixes a Time-of-Check to Time-of-Use (TOCTOU) vulnerability within the FileHandler session driver.

I don't think this is really a TOCTOU fix. The patched code still performs several non-atomic check-then-use operations: lstat(), is_link(), is_file(), then @unlink(). The symlink-following behavior is from filemtime(), not from unlink(): unlink() deletes the symlink entry, not the file it points to.

In a shared hosting environment with a predictable or shared session save path (like /tmp)...

The described scenario depends on using a shared session save path such as /tmp, but the user guide explicitly warns not to use publicly readable or shared directories for FileHandler sessions and says only our app should have access to the savePath. The default savePath is WRITEPATH . 'session'.

an attacker could potentially replace their session file with a symlink pointing to another system file.

If we assume symlink planting in the session save path is something we want to protect against, then read() and write() also need to be considered, because they use fopen(), touch(), and ftruncate() on the same path and still follow symlinks.

It also resolves false-positives raised by strict security scanners regarding the lack of is_link checks before unlink.

I don't think scanner false positives alone are enough reason to change runtime behavior here.

Overall, IMO these changes are not necessary.

[michalsn]

Once is_link() filters links out, filemtime() on a non-link equals the stat['mtime'] - the whole lstat() call is unnecessary.