[HttpFoundation] Add OTIONS and TRACE to the list of safe methods

dunglas · dunglas · commit b7a24e242f0e · 2016-07-09T10:59:31.000+02:00
diff --git a/src/Symfony/Component/HttpFoundation/Request.php b/src/Symfony/Component/HttpFoundation/Request.php
@@ -1470,7 +1470,7 @@ public function isMethod($method)
      */
     public function isMethodSafe()
     {
-        return in_array($this->getMethod(), array('GET', 'HEAD'));
+        return in_array($this->getMethod(), array('GET', 'HEAD', 'OPTIONS', 'TRACE'));
     }
 
     /**
diff --git a/src/Symfony/Component/HttpFoundation/Tests/RequestTest.php b/src/Symfony/Component/HttpFoundation/Tests/RequestTest.php
@@ -1912,6 +1912,32 @@ public function getLongHostNames()
             array(str_repeat(':', 101)),
         );
     }
+
+    /**
+     * @dataProvider methodProvider
+     */
+    public function testMethodSafe()
+    {
+        $request = new Request();
+        $request->setMethod(Request::METHOD_GET);
+        $this->assertTrue($request->isMethodSafe());
+    }
+
+    public function methodProvider()
+    {
+        return array(
+            array(Request::METHOD_HEAD, true),
+            array(Request::METHOD_GET, true),
+            array(Request::METHOD_POST, false),
+            array(Request::METHOD_PUT, false),
+            array(Request::METHOD_PATCH, false),
+            array(Request::METHOD_DELETE, false),
+            array(Request::METHOD_PURGE, false),
+            array(Request::METHOD_OPTIONS, true),
+            array(Request::METHOD_TRACE, true),
+            array(Request::METHOD_CONNECT, false),
+        );
+    }
 }
 
 class RequestContentProxy extends Request

Original file line number	Diff line number	Diff line change
`@@ -1470,7 +1470,7 @@ public function isMethod($method)`
`1470`	`1470`	`*/`
`1471`	`1471`	`public function isMethodSafe()`
`1472`	`1472`	`{`
`1473`		`- return in_array($this->getMethod(), array('GET', 'HEAD'));`
	`1473`	`+ return in_array($this->getMethod(), array('GET', 'HEAD', 'OPTIONS', 'TRACE'));`
`1474`	`1474`	`}`
`1475`	`1475`
`1476`	`1476`	`/**`