Skip to content

Conversation

@nikhil-marne
Copy link

This PR aggregates 9 critical fixes to modernize the library:

  1. Security: Fixed XXE vulnerability in XmlHandler.
  2. Security: Fixed Proxy Authentication headers (Issue Curl proxy configuration is not used by Httpful #289).
  3. PHP 8.2: Added #[AllowDynamicProperties] to Response to fix deprecations.
  4. PHP 8.1: Added null checks in Mime.php and attributes in Headers.php.
  5. JSON: Added support for JSON:API and Problem+JSON types.
  6. JSON: Fixed crash on empty response body in JsonHandler.
  7. Bootstrap: Fixed double-initialization bug.
  8. Stability: Added withoutStrictConnection() to handle network failures gracefully.
  9. Bugfix: Fixed HTTP 100 Continue parsing error.

The previous implementation only checked `empty($body)`, which failed to catch response bodies containing only whitespace (e.g., newlines or spaces).

This caused `json_decode` to return null, which subsequently triggered a `JsonParseException` for valid requests that simply had no content.

Changes made:
- Added `trim($body) === ''` check in `src/Httpful/Handlers/JsonHandler.php` to return null immediately for whitespace-only bodies.

Ref: Issue nategood#268 (Unable to parse response as JSON on empty body)
Currently, any connection failure (DNS resolution, timeout, connection refused) throws a fatal ConnectionErrorException. This interrupts the flow for applications that want to handle site downtime gracefully.

Changes made:
- Added `$suppress_connection_errors` property to Request class.
- Added `withoutStrictConnection()` chainable method.
- Modified `buildResponse` to check this flag. If set, it returns a generated Response object with HTTP 523 (Origin Unreachable) instead of throwing an exception.

Ref: Issue nategood#260 (Connection Errors Throw Exceptions)
The XML parser previously allowed loading of external entities by default on older PHP versions, creating a security vulnerability (XXE) where attackers could read local system files.

Changes made:
- Updated `parse` method in `src/Httpful/Handlers/XmlHandler.php`.
- Conditionally disabled `libxml_disable_entity_loader` for PHP < 8.0 to prevent XXE.
- Skipped this check for PHP 8.0+ to avoid deprecation warnings (as it is safe by default).
This commit addresses two distinct issues related to modern environment compatibility:

1. PHP 8.2 Compatibility:
   - Added `#[AllowDynamicProperties]` to the `Response` class.
   - This prevents "Deprecated: Creation of dynamic property" warnings in PHP 8.2+.

2. HTTP 100 Continue Bug:
   - Updated `Request::buildResponse` to detect and strip "HTTP/1.1 100 Continue" headers.
   - This ensures the parser correctly identifies the actual response headers and body, preventing malformed response objects.
1. Added support for 'application/vnd.api+json' (JSON:API) and 'application/problem+json' (RFC 7807). This allows users to use short names 'json_api' and 'problem_json'.
2. Added null checks in `getFullMime` and `supportsMimeType`. This prevents "Deprecated: Passing null to parameter" warnings in PHP 8.1+.
1. Modified `Bootstrap::init` and `Bootstrap::pharInit` to check `self::$registered` before registering autoloaders. This prevents duplicate autoloader registration when the library is included multiple times or in complex environments.
2. Updated `registerHandlers` to map `application/vnd.api+json` and `application/problem+json` to the existing `JsonHandler`. This ensures these common API formats are parsed automatically.
1. Updated `fromString` to handle duplicate headers (e.g., multiple Set-Cookie lines). Previously, subsequent headers with the same name would overwrite the first one. They are now concatenated with a comma as per RFC 2616.
2. Added `#[ReturnTypeWillChange]` attributes to `ArrayAccess` and `Countable` methods to suppress deprecation notices in PHP 8.1+.
Added `stripBom()` call to `FormHandler::parse`. 
Without this, responses starting with a Byte Order Mark would result in the first key of the parsed array being corrupted/inaccessible.
1. Added validation to `Httpful::register` to ensure the mimeType is a valid string.
2. Updated `Httpful::get` to handle null/empty mime types explicitly.
3. Bumped VERSION constant to 0.3.0 to signify the inclusion of PHP 8.1/8.2 compatibility fixes, security patches (XXE), and modern JSON support.
1. Created `src/Httpful/Exception.php` as a base exception class.
2. Updated `ConnectionErrorException` to extend `Httpful\Exception`.
This allows developers to catch all library-specific exceptions using `catch (\Httpful\Exception $e)`.
1. Bumped version to 0.3.0 to match the code updates.
2. Updated PHP requirement to >=7.2 to ensure stability with modern features.
3. Explicitly added `ext-json` and `ext-simplexml` requirements since the library relies on them.
4. Locked `phpunit/phpunit` to ^8.0 || ^9.0 to prevent build failures caused by incompatible newer versions of PHPUnit being installed by default.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant