Skip to content

Commit cd01e04

Browse files
priyadipriyadi
authored
fix(symfony): handle empty content-type as set by Symfony (api-platform#6078)
* fix: requests with an empty content type In PHP, requests without content-type will result in a content-type header containing an empty string, not null * test: add tests for content type containing an empty string * test: added a test for DeserializeListener
1 parent 5687986 commit cd01e04

File tree

6 files changed

+183
-3
lines changed

6 files changed

+183
-3
lines changed

‎src/State/Provider/ContentNegotiationProvider.php

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -97,7 +97,8 @@ private function flattenMimeTypes(array $formats): array
9797
*/
9898
private function getInputFormat(HttpOperation $operation, Request $request): ?string
9999
{
100-
if (null === ($contentType = $request->headers->get('CONTENT_TYPE'))) {
100+
$contentType = $request->headers->get('CONTENT_TYPE');
101+
if (null === $contentType || '' === $contentType) {
101102
return null;
102103
}
103104

‎src/State/Provider/DeserializeProvider.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@ public function provide(Operation $operation, array $uriVariables = [], array $c
5656
}
5757

5858
$contentType = $request->headers->get('CONTENT_TYPE');
59-
if (null === $contentType) {
59+
if (null === $contentType || '' === $contentType) {
6060
throw new UnsupportedMediaTypeHttpException('The "Content-Type" header must exist.');
6161
}
6262

‎src/Symfony/EventListener/DeserializeListener.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -132,7 +132,7 @@ private function getFormat(Request $request, array $formats): string
132132
{
133133
/** @var ?string $contentType */
134134
$contentType = $request->headers->get('CONTENT_TYPE');
135-
if (null === $contentType) {
135+
if (null === $contentType || '' === $contentType) {
136136
throw new UnsupportedMediaTypeHttpException('The "Content-Type" header must exist.');
137137
}
138138

‎tests/State/Provider/ContentNegotiationProviderTest.php

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
<?php
2+
3+
/*
4+
* This file is part of the API Platform project.
5+
*
6+
* (c) Kévin Dunglas <[email protected]>
7+
*
8+
* For the full copyright and license information, please view the LICENSE
9+
* file that was distributed with this source code.
10+
*/
11+
12+
declare(strict_types=1);
13+
14+
namespace ApiPlatform\Tests\State\Provider;
15+
16+
use ApiPlatform\Metadata\Post;
17+
use ApiPlatform\State\Provider\ContentNegotiationProvider;
18+
use ApiPlatform\State\ProviderInterface;
19+
use Negotiation\Negotiator;
20+
use PHPUnit\Framework\TestCase;
21+
use Prophecy\Argument;
22+
use Prophecy\PhpUnit\ProphecyTrait;
23+
use Symfony\Component\HttpFoundation\Request;
24+
25+
class ContentNegotiationProviderTest extends TestCase
26+
{
27+
use ProphecyTrait;
28+
29+
public function testRequestWithEmptyContentType(): void
30+
{
31+
$expectedResult = new \stdClass();
32+
33+
$decorated = $this->prophesize(ProviderInterface::class);
34+
$decorated->provide(Argument::cetera())->willReturn($expectedResult);
35+
36+
$negotiator = new Negotiator();
37+
$formats = ['jsonld' => ['application/ld+json']];
38+
$errorFormats = ['jsonld' => ['application/ld+json']];
39+
40+
$provider = new ContentNegotiationProvider($decorated->reveal(), $negotiator, $formats, $errorFormats);
41+
42+
// in Symfony (at least up to 7.0.2, 6.4.2, 6.3.11, 5.4.34), a request
43+
// without a content-type and content-length header will result in the
44+
// variables set to an empty string, not null
45+
46+
$request = new Request(
47+
server: [
48+
'REQUEST_METHOD' => 'POST',
49+
'REQUEST_URI' => '/',
50+
'CONTENT_TYPE' => '',
51+
'CONTENT_LENGTH' => '',
52+
],
53+
content: ''
54+
);
55+
56+
$operation = new Post();
57+
$context = ['request' => $request];
58+
59+
$result = $provider->provide($operation, [], $context);
60+
61+
$this->assertSame($expectedResult, $result);
62+
}
63+
}

‎tests/State/Provider/DeserializeProviderTest.php

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
<?php
2+
3+
/*
4+
* This file is part of the API Platform project.
5+
*
6+
* (c) Kévin Dunglas <[email protected]>
7+
*
8+
* For the full copyright and license information, please view the LICENSE
9+
* file that was distributed with this source code.
10+
*/
11+
12+
declare(strict_types=1);
13+
14+
namespace ApiPlatform\Tests\State\Provider;
15+
16+
use ApiPlatform\Metadata\Post;
17+
use ApiPlatform\Serializer\SerializerContextBuilderInterface;
18+
use ApiPlatform\State\Provider\DeserializeProvider;
19+
use ApiPlatform\State\ProviderInterface;
20+
use PHPUnit\Framework\TestCase;
21+
use Prophecy\Argument;
22+
use Prophecy\PhpUnit\ProphecyTrait;
23+
use Symfony\Component\HttpFoundation\Request;
24+
use Symfony\Component\HttpKernel\Exception\UnsupportedMediaTypeHttpException;
25+
use Symfony\Component\Serializer\SerializerInterface;
26+
27+
class DeserializeProviderTest extends TestCase
28+
{
29+
use ProphecyTrait;
30+
31+
public function testRequestWithEmptyContentType(): void
32+
{
33+
$expectedResult = new \stdClass();
34+
35+
$decorated = $this->prophesize(ProviderInterface::class);
36+
$decorated->provide(Argument::cetera())->willReturn($expectedResult);
37+
38+
$serializer = $this->prophesize(SerializerInterface::class);
39+
$serializerContextBuilder = $this->prophesize(SerializerContextBuilderInterface::class);
40+
41+
$provider = new DeserializeProvider($decorated->reveal(), $serializer->reveal(), $serializerContextBuilder->reveal());
42+
43+
// in Symfony (at least up to 7.0.2, 6.4.2, 6.3.11, 5.4.34), a request
44+
// without a content-type and content-length header will result in the
45+
// variables set to an empty string, not null
46+
47+
$request = new Request(
48+
server: [
49+
'REQUEST_METHOD' => 'POST',
50+
'REQUEST_URI' => '/',
51+
'CONTENT_TYPE' => '',
52+
'CONTENT_LENGTH' => '',
53+
],
54+
content: ''
55+
);
56+
57+
$operation = new Post(deserialize: true);
58+
$context = ['request' => $request];
59+
60+
$this->expectException(UnsupportedMediaTypeHttpException::class);
61+
$result = $provider->provide($operation, [], $context);
62+
}
63+
}

‎tests/Symfony/EventListener/DeserializeListenerTest.php

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@
2828
use Symfony\Component\HttpFoundation\Request;
2929
use Symfony\Component\HttpKernel\Event\RequestEvent;
3030
use Symfony\Component\HttpKernel\Exception\UnsupportedMediaTypeHttpException;
31+
use Symfony\Component\HttpKernel\HttpKernelInterface;
3132
use Symfony\Component\Serializer\Exception\NotNormalizableValueException;
3233
use Symfony\Component\Serializer\Exception\PartialDenormalizationException;
3334
use Symfony\Component\Serializer\Normalizer\AbstractNormalizer;
@@ -369,4 +370,56 @@ public function testTurnPartialDenormalizationExceptionIntoValidationException()
369370
$this->assertSame($violation->getCode(), 'ba785a8c-82cb-4283-967c-3cf342181b40');
370371
}
371372
}
373+
374+
public function testRequestWithEmptyContentType(): void
375+
{
376+
$serializerProphecy = $this->prophesize(SerializerInterface::class);
377+
$serializerProphecy->deserialize(Argument::cetera())->shouldNotBeCalled();
378+
379+
$serializerContextBuilderProphecy = $this->prophesize(SerializerContextBuilderInterface::class);
380+
$serializerContextBuilderProphecy->createFromRequest(Argument::cetera())->willReturn([]);
381+
382+
$resourceMetadataFactoryProphecy = $this->prophesize(ResourceMetadataCollectionFactoryInterface::class);
383+
$resourceMetadataFactoryProphecy->create(Argument::cetera())->willReturn(new ResourceMetadataCollection(Dummy::class, [
384+
new ApiResource(operations: [
385+
'post' => new Post(inputFormats: self::FORMATS),
386+
]),
387+
]))->shouldBeCalled();
388+
389+
$listener = new DeserializeListener(
390+
$serializerProphecy->reveal(),
391+
$serializerContextBuilderProphecy->reveal(),
392+
$resourceMetadataFactoryProphecy->reveal()
393+
);
394+
395+
// in Symfony (at least up to 7.0.2, 6.4.2, 6.3.11, 5.4.34), a request
396+
// without a content-type and content-length header will result in the
397+
// variables set to an empty string, not null
398+
399+
$request = new Request(
400+
server: [
401+
'REQUEST_METHOD' => 'POST',
402+
'REQUEST_URI' => '/',
403+
'CONTENT_TYPE' => '',
404+
'CONTENT_LENGTH' => '',
405+
],
406+
attributes: [
407+
'_api_resource_class' => Dummy::class,
408+
'_api_operation_name' => 'post',
409+
'_api_receive' => true,
410+
],
411+
content: ''
412+
);
413+
414+
$event = new RequestEvent(
415+
$this->prophesize(HttpKernelInterface::class)->reveal(),
416+
$request,
417+
\defined(HttpKernelInterface::class.'::MAIN_REQUEST') ? HttpKernelInterface::MAIN_REQUEST : HttpKernelInterface::MASTER_REQUEST,
418+
);
419+
420+
$this->expectException(UnsupportedMediaTypeHttpException::class);
421+
$this->expectExceptionMessage('The "Content-Type" header must exist.');
422+
423+
$listener->onKernelRequest($event);
424+
}
372425
}

0 commit comments

Comments
 (0)