Skip to content

Commit

Permalink
Patch header validation issue
Browse files Browse the repository at this point in the history
  • Loading branch information
GrahamCampbell committed Apr 17, 2023
1 parent 0e75375 commit 18fd891
Show file tree
Hide file tree
Showing 3 changed files with 20 additions and 7 deletions.
13 changes: 6 additions & 7 deletions src/MessageTrait.php
Original file line number Diff line number Diff line change
Expand Up @@ -226,12 +226,9 @@ private function assertHeader($header)
throw new \InvalidArgumentException('Header name can not be empty.');
}

if (! preg_match('/^[a-zA-Z0-9\'`#$%&*+.^_|~!-]+$/', $header)) {
if (! preg_match('/^[a-zA-Z0-9\'`#$%&*+.^_|~!-]+$/D', $header)) {
throw new \InvalidArgumentException(
sprintf(
'"%s" is not valid header name',
$header
)
sprintf('"%s" is not valid header name.', $header)
);
}
}
Expand Down Expand Up @@ -263,8 +260,10 @@ private function assertValue($value)
// Clients must not send a request with line folding and a server sending folded headers is
// likely very rare. Line folding is a fairly obscure feature of HTTP/1.1 and thus not accepting
// folding is not likely to break any legitimate use case.
if (! preg_match('/^[\x20\x09\x21-\x7E\x80-\xFF]*$/', $value)) {
throw new \InvalidArgumentException(sprintf('"%s" is not valid header value', $value));
if (! preg_match('/^[\x20\x09\x21-\x7E\x80-\xFF]*$/D', $value)) {
throw new \InvalidArgumentException(
sprintf('"%s" is not valid header value.', $value)
);
}
}
}
5 changes: 5 additions & 0 deletions tests/RequestTest.php
Original file line number Diff line number Diff line change
Expand Up @@ -269,6 +269,10 @@ public function provideHeaderValuesContainingNotAllowedChars()
// Line folding is technically allowed, but deprecated.
// We don't support it.
["new\r\n line"],
["newline\n"],
["\nnewline"],
["newline\r\n"],
["\r\nnewline"],
];

for ($i = 0; $i <= 0xff; $i++) {
Expand All @@ -286,6 +290,7 @@ public function provideHeaderValuesContainingNotAllowedChars()
}

$tests[] = ["foo" . \chr($i) . "bar"];
$tests[] = ["foo" . \chr($i)];
}

return $tests;
Expand Down
9 changes: 9 additions & 0 deletions tests/ResponseTest.php
Original file line number Diff line number Diff line change
Expand Up @@ -284,6 +284,15 @@ public function invalidWithHeaderProvider()
[[], 'foo', 'Header name must be a string but array provided.'],
[false, 'foo', 'Header name must be a string but boolean provided.'],
[new \stdClass(), 'foo', 'Header name must be a string but stdClass provided.'],
["", 'foo', "Header name can not be empty."],
["Content-Type\r\n\r\n", 'foo', "\"Content-Type\r\n\r\n\" is not valid header name."],
["Content-Type\r\n", 'foo', "\"Content-Type\r\n\" is not valid header name."],
["Content-Type\n", 'foo', "\"Content-Type\n\" is not valid header name."],
["\r\nContent-Type", 'foo', "\"\r\nContent-Type\" is not valid header name."],
["\nContent-Type", 'foo', "\"\nContent-Type\" is not valid header name."],
["\n", 'foo', "\"\n\" is not valid header name."],
["\r\n", 'foo', "\"\r\n\" is not valid header name."],
["\t", 'foo', "\"\t\" is not valid header name."],
]);
}

Expand Down

0 comments on commit 18fd891

Please sign in to comment.