bug #47415 [HttpClient] Psr18Client ignore invalid HTTP headers (nuryagdym)

nicolas-grekas · nicolas-grekas · commit b96f1c48b0e9 · 2022-09-04T20:32:13.000+02:00
This PR was merged into the 4.4 branch. Discussion ---------- [HttpClient] Psr18Client ignore invalid HTTP headers | Q | A | ------------- | --- | Branch? | 4.4 | Bug fix? | yes | New feature? | no | Deprecations? | no | Tickets | | License | MIT | Doc PR | symfony/symfony-docs Hi, I working on a library that I am working on supports PSR-18 and PSR-7 implementations. I tried following PSR-7 libraries: nyholm/psr7 laminas/laminas-diactoros slim/psr7 and following PSR-18 clients: php-http/curl-client symfony/http-client guzzlehttp/guzzle and when I tried combination of all these PSR-7 and PSR-18 libraries. I faced issue only on `symfony/http-client` _Psr18Client_ client. Error is caused when I received response with header name containing leading space " x-xss-protection". This library does not trim response header names that is why all 3 PSR-7 libraries throwing error "**Header values must be RFC 7230 compatible strings**" when used in combination with `symfony/http-client`. The other 2 PSR-18 clients trim header names: [guzzlehttp/guzzle: GuzzleHttp\Handler\CurlFactory::createHeaderFn()](https://github.com/guzzle/guzzle/blob/b50a2a1251152e43f6a37f0fa053e730a67d25ba/src/Handler/CurlFactory.php#L567) [php-http/curl-client: Http\Client\Curl\Client::prepareRequestOptions()](https://github.com/php-http/curl-client/blob/2ed4245a817d859dd0c1d51c7078cdb343cf5233/src/Client.php#L226) So, I added trim line on _Psr18Client_, hope it does not break anything, it is working for me at least. I guess this fix should be done on all maintained versions of this library as well. PS I also, tried to trim using `Symfony\Component\HttpClient\HttpClientTrait::normalizeHeaders()` but it does not do anything about this leading space in the header name. Commits ------- f6f8748 Psr18Client ignore invalid HTTP headers
diff --git a/src/Symfony/Component/HttpClient/Psr18Client.php b/src/Symfony/Component/HttpClient/Psr18Client.php
@@ -100,7 +100,11 @@ public function sendRequest(RequestInterface $request): ResponseInterface
 
             foreach ($response->getHeaders(false) as $name => $values) {
                 foreach ($values as $value) {
-                    $psrResponse = $psrResponse->withAddedHeader($name, $value);
+                    try {
+                        $psrResponse = $psrResponse->withAddedHeader($name, $value);
+                    } catch (\InvalidArgumentException $e) {
+                        // ignore invalid header
+                    }
                 }
             }
 
diff --git a/src/Symfony/Component/HttpClient/Tests/Psr18ClientTest.php b/src/Symfony/Component/HttpClient/Tests/Psr18ClientTest.php
@@ -13,10 +13,12 @@
 
 use Nyholm\Psr7\Factory\Psr17Factory;
 use PHPUnit\Framework\TestCase;
+use Symfony\Component\HttpClient\MockHttpClient;
 use Symfony\Component\HttpClient\NativeHttpClient;
 use Symfony\Component\HttpClient\Psr18Client;
 use Symfony\Component\HttpClient\Psr18NetworkException;
 use Symfony\Component\HttpClient\Psr18RequestException;
+use Symfony\Component\HttpClient\Response\MockResponse;
 use Symfony\Contracts\HttpClient\Test\TestHttpServer;
 
 class Psr18ClientTest extends TestCase
@@ -81,4 +83,22 @@ public function test404()
         $response = $client->sendRequest($factory->createRequest('GET', 'http://localhost:8057/404'));
         $this->assertSame(404, $response->getStatusCode());
     }
+
+    public function testInvalidHeaderResponse()
+    {
+        $responseHeaders = [
+            // space in header name not allowed in RFC 7230
+            ' X-XSS-Protection' => '0',
+            'Cache-Control' => 'no-cache',
+        ];
+        $response = new MockResponse('body', ['response_headers' => $responseHeaders]);
+        $this->assertArrayHasKey(' x-xss-protection', $response->getHeaders());
+
+        $client = new Psr18Client(new MockHttpClient($response));
+        $request = $client->createRequest('POST', 'http://localhost:8057/post')
+            ->withBody($client->createStream('foo=0123456789'));
+
+        $resultResponse = $client->sendRequest($request);
+        $this->assertCount(1, $resultResponse->getHeaders());
+    }
 }

Original file line number	Diff line number	Diff line change
`@@ -100,7 +100,11 @@ public function sendRequest(RequestInterface $request): ResponseInterface`
`100`	`100`
`101`	`101`	`foreach ($response->getHeaders(false) as $name => $values) {`
`102`	`102`	`foreach ($values as $value) {`
`103`		`- $psrResponse = $psrResponse->withAddedHeader($name, $value);`
	`103`	`+ try {`
	`104`	`+ $psrResponse = $psrResponse->withAddedHeader($name, $value);`
	`105`	`+ } catch (\InvalidArgumentException $e) {`
	`106`	`+ // ignore invalid header`
	`107`	`+ }`
`104`	`108`	`}`
`105`	`109`	`}`
`106`	`110`