Movatterモバイル変換


[0]ホーム

URL:


Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

[HttpClient] Psr18Client ignore invalid HTTP headers#47415

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Merged
nicolas-grekas merged 1 commit intosymfony:4.4fromnuryagdym:patch-2
Sep 4, 2022
Merged

[HttpClient] Psr18Client ignore invalid HTTP headers#47415

nicolas-grekas merged 1 commit intosymfony:4.4fromnuryagdym:patch-2
Sep 4, 2022

Conversation

@nuryagdym
Copy link
Contributor

QA
Branch?4.4
Bug fix?yes
New feature?no
Deprecations?no
Tickets
LicenseMIT
Doc PRsymfony/symfony-docs

Hi,
I working on a library that I am working on supports PSR-18 and PSR-7 implementations.
I tried following PSR-7 libraries:
nyholm/psr7
laminas/laminas-diactoros
slim/psr7

and following PSR-18 clients:
php-http/curl-client
symfony/http-client
guzzlehttp/guzzle

and when I tried combination of all these PSR-7 and PSR-18 libraries.
I faced issue only onsymfony/http-clientPsr18Client client.
Error is caused when I received response with header name containing leading space " x-xss-protection". This library does not trim response header names that is why all 3 PSR-7 libraries throwing error "Header values must be RFC 7230 compatible strings" when used in combination withsymfony/http-client.
The other 2 PSR-18 clients trim header names:

guzzlehttp/guzzle: GuzzleHttp\Handler\CurlFactory::createHeaderFn()

php-http/curl-client: Http\Client\Curl\Client::prepareRequestOptions()

So, I added trim line onPsr18Client, hope it does not break anything, it is working for me at least.

I guess this fix should be done on all maintained versions of this library as well.

PS
I also, tried to trim usingSymfony\Component\HttpClient\HttpClientTrait::normalizeHeaders() but it does not do anything about this leading space in the header name.

@carsonbot
Copy link

Hey!

I see that this is your first PR. That is great! Welcome!

Symfony has acontribution guide which I suggest you to read.

In short:

  • Always add tests
  • Keep backward compatibility (seehttps://symfony.com/bc).
  • Bug fixes must be submitted against the lowest maintained branch where they apply (seehttps://symfony.com/releases)
  • Features and deprecations must be submitted against the 6.2 branch.

Review the GitHub status checks of your pull request and try to solve the reported issues. If some tests are failing, try to see if they are failing because of this change.

When two Symfony core team members approve this change, it will be merged and you will become an official Symfony contributor!
If this PR is merged in a lower version branch, it will be merged up to all maintained branches within a few days.

I am going to sit back now and wait for the reviews.

Cheers!

Carsonbot

@nicolas-grekas
Copy link
Member

This doesn't seem legit to me.The HTTP 1.1 specification doesn't allow spaces before names.

@nuryagdym
Copy link
ContributorAuthor

This is true, normally it must not be space. But I am sending a request to the payment gateway of the old State Bank. And they have this issue in their header response. As this trimming is done on other HTTP client libraries, I thought we could also add it in symfony client

@nicolas-grekas
Copy link
Member

Can you share a raw response from this server? (after removing any confidential info of course)
Can you read the field if you add the space yourself when accessing it?

@nuryagdym
Copy link
ContributorAuthor

This is the example curl command:

curl_setopt_array($curl, [CURLOPT_HEADER =>true,CURLOPT_URL            =>'https://3dsecure.vakifbank.com.tr:4443/MPIAPI/MPI_Enrollment.aspx',CURLOPT_RETURNTRANSFER =>true,CURLOPT_ENCODING       =>'',CURLOPT_MAXREDIRS      =>10,CURLOPT_TIMEOUT        =>0,CURLOPT_FOLLOWLOCATION =>true,CURLOPT_HTTP_VERSION   =>CURL_HTTP_VERSION_1_1,CURLOPT_CUSTOMREQUEST  =>'POST',CURLOPT_POSTFIELDS     =>'MerchantId=000000000111111&MerchantPassword=3XTgER89as&MerchantType=0&PurchaseAmount=1.01&VerifyEnrollmentRequestId=ce7067e9ccd023889124a8dde4b5fd5b&Currency=949',CURLOPT_HTTPHEADER     => ['Host: 3dsecure.vakifbank.com.tr','User-Agent: Symfony HttpClient/Curl','Content-Type: application/x-www-form-urlencoded'    ],]);$response =curl_exec($curl);$header_size =curl_getinfo($curl,CURLINFO_HEADER_SIZE);$header =substr($response,0,$header_size);curl_close($curl);

you can also run it and check. Here is what I see when I dump this$header:
image

@nicolas-grekas
Copy link
Member

nicolas-grekas commentedAug 29, 2022
edited
Loading

Do browsers understand this header? Any link that tells about that?

@nuryagdym
Copy link
ContributorAuthor

This is an API call, browsers don't render the content received from this response. I just parse the XML response and use the data I get.
On Postman it is working:

curl --location --request POST'https://3dsecure.vakifbank.com.tr:4443/MPIAPI/MPI_Enrollment.aspx' \--header'Host: 3dsecure.vakifbank.com.tr' \--header'User-Agent: Symfony HttpClient/Curl' \--header'Content-Type: application/x-www-form-urlencoded' \--data-urlencode'MerchantId=000000000111111' \--data-urlencode'MerchantPassword=3XTgER89as' \--data-urlencode'MerchantType=0' \--data-urlencode'PurchaseAmount=1.01' \--data-urlencode'VerifyEnrollmentRequestId=ce7067e9ccd023889124a8dde4b5fd5b' \--data-urlencode'Currency=949'

image
image

@nicolas-grekas
Copy link
Member

nicolas-grekas commentedAug 29, 2022
edited
Loading

OK understood. Let's do as postman, aka ignore invalid headers.
That means theforeach ($value) should be wrapped in a try/catch(\InvalidArgumentException).
Can you please update the PR and add a test case?

@nuryagdym
Copy link
ContributorAuthor

All right, I will do necessary changes within this week.
Thanks

nicolas-grekas reacted with thumbs up emoji

@carsonbotcarsonbot changed the titlePsr18Client Trim Response Header Names[HttpClient] Psr18Client Trim Response Header NamesSep 2, 2022
@nuryagdym
Copy link
ContributorAuthor

Hi@nicolas-grekas, I did the changes you asked

@nicolas-grekasnicolas-grekas changed the title[HttpClient] Psr18Client Trim Response Header Names[HttpClient] Psr18Client ignore invalid HTTP headersSep 4, 2022
@nicolas-grekas
Copy link
Member

Thank you@nuryagdym.

@nicolas-grekasnicolas-grekas merged commitb96f1c4 intosymfony:4.4Sep 4, 2022
This was referencedSep 30, 2022
nicolas-grekas added a commit that referenced this pull requestMay 3, 2023
…ders (nicolas-grekas)This PR was merged into the 5.4 branch.Discussion----------[HttpClient] Ensure HttplugClient ignores invalid HTTP headers| Q             | A| ------------- | ---| Branch?       | 5.4| Bug fix?      | yes| New feature?  | no| Deprecations? | no| Tickets       | -| License       | MIT| Doc PR        | -Something we forgot in#47415Commits-------f702e66 [HttpClient] Ensure HttplugClient ignores invalid HTTP headers
Sign up for freeto join this conversation on GitHub. Already have an account?Sign in to comment

Reviewers

@nicolas-grekasnicolas-grekasnicolas-grekas approved these changes

Assignees

No one assigned

Projects

None yet

Milestone

4.4

Development

Successfully merging this pull request may close these issues.

4 participants

@nuryagdym@carsonbot@nicolas-grekas@xabbuh

[8]ページ先頭

©2009-2025 Movatter.jp