Language: PHP
Label: vulnerable
CWE: CWE-384 \u2014 Session Fixation
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

Code:
    public function testGetSessionCartExists()
    {
        $service = new \Box\Mod\Cart\Service();

        $session_id = 'rrcpqo7tkjh14d2vmf0car64k7';

        $model = new \Model_Cart();
        $model->loadBean(new \DummyBean());
        $model->session_id = $session_id;

        $dbMock = $this->getMockBuilder('Box_Database')->getMock();
        $dbMock->expects($this->atLeastOnce())
            ->method('findOne')
            ->will($this->returnValue($model));

        $sessionMock = $this->getMockBuilder("\Box_Session")
            ->disableOriginalConstructor()
            ->getMock();
        $sessionMock->expects($this->atLeastOnce())
            ->method("getId")
            ->will($this->returnValue($session_id));

        $di            = new \Pimple\Container();
        $di['db']      = $dbMock;
        $di['session'] = $sessionMock;
        $service->setDi($di);

        $result = $service->getSessionCart();

        $this->assertInstanceOf('Model_Cart', $result);
        $this->assertEquals($result->session_id, $session_id);
    }