-
Notifications
You must be signed in to change notification settings - Fork 303
Modernization: Fix security issues and add PHP 8.2 support #313
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Open
nikhil-marne
wants to merge
13
commits into
nategood:dev
Choose a base branch
from
nikhil-marne:dev
base: dev
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
The previous implementation only checked `empty($body)`, which failed to catch response bodies containing only whitespace (e.g., newlines or spaces). This caused `json_decode` to return null, which subsequently triggered a `JsonParseException` for valid requests that simply had no content. Changes made: - Added `trim($body) === ''` check in `src/Httpful/Handlers/JsonHandler.php` to return null immediately for whitespace-only bodies. Ref: Issue nategood#268 (Unable to parse response as JSON on empty body)
Currently, any connection failure (DNS resolution, timeout, connection refused) throws a fatal ConnectionErrorException. This interrupts the flow for applications that want to handle site downtime gracefully. Changes made: - Added `$suppress_connection_errors` property to Request class. - Added `withoutStrictConnection()` chainable method. - Modified `buildResponse` to check this flag. If set, it returns a generated Response object with HTTP 523 (Origin Unreachable) instead of throwing an exception. Ref: Issue nategood#260 (Connection Errors Throw Exceptions)
The XML parser previously allowed loading of external entities by default on older PHP versions, creating a security vulnerability (XXE) where attackers could read local system files. Changes made: - Updated `parse` method in `src/Httpful/Handlers/XmlHandler.php`. - Conditionally disabled `libxml_disable_entity_loader` for PHP < 8.0 to prevent XXE. - Skipped this check for PHP 8.0+ to avoid deprecation warnings (as it is safe by default).
This commit addresses two distinct issues related to modern environment compatibility: 1. PHP 8.2 Compatibility: - Added `#[AllowDynamicProperties]` to the `Response` class. - This prevents "Deprecated: Creation of dynamic property" warnings in PHP 8.2+. 2. HTTP 100 Continue Bug: - Updated `Request::buildResponse` to detect and strip "HTTP/1.1 100 Continue" headers. - This ensures the parser correctly identifies the actual response headers and body, preventing malformed response objects.
1. Added support for 'application/vnd.api+json' (JSON:API) and 'application/problem+json' (RFC 7807). This allows users to use short names 'json_api' and 'problem_json'. 2. Added null checks in `getFullMime` and `supportsMimeType`. This prevents "Deprecated: Passing null to parameter" warnings in PHP 8.1+.
1. Modified `Bootstrap::init` and `Bootstrap::pharInit` to check `self::$registered` before registering autoloaders. This prevents duplicate autoloader registration when the library is included multiple times or in complex environments. 2. Updated `registerHandlers` to map `application/vnd.api+json` and `application/problem+json` to the existing `JsonHandler`. This ensures these common API formats are parsed automatically.
1. Updated `fromString` to handle duplicate headers (e.g., multiple Set-Cookie lines). Previously, subsequent headers with the same name would overwrite the first one. They are now concatenated with a comma as per RFC 2616. 2. Added `#[ReturnTypeWillChange]` attributes to `ArrayAccess` and `Countable` methods to suppress deprecation notices in PHP 8.1+.
Added `stripBom()` call to `FormHandler::parse`. Without this, responses starting with a Byte Order Mark would result in the first key of the parsed array being corrupted/inaccessible.
1. Added validation to `Httpful::register` to ensure the mimeType is a valid string. 2. Updated `Httpful::get` to handle null/empty mime types explicitly. 3. Bumped VERSION constant to 0.3.0 to signify the inclusion of PHP 8.1/8.2 compatibility fixes, security patches (XXE), and modern JSON support.
1. Created `src/Httpful/Exception.php` as a base exception class. 2. Updated `ConnectionErrorException` to extend `Httpful\Exception`. This allows developers to catch all library-specific exceptions using `catch (\Httpful\Exception $e)`.
1. Bumped version to 0.3.0 to match the code updates. 2. Updated PHP requirement to >=7.2 to ensure stability with modern features. 3. Explicitly added `ext-json` and `ext-simplexml` requirements since the library relies on them. 4. Locked `phpunit/phpunit` to ^8.0 || ^9.0 to prevent build failures caused by incompatible newer versions of PHPUnit being installed by default.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR aggregates 9 critical fixes to modernize the library: