Potential bug in stream conversion

[Xerkus]

Bug Report

Q	A
Version(s)	1.9.0

Summary

Conversion of stream resource from PSR-7 response to Laminas response assumes PSR-7 resource is a stream that can be reopened with fopen using metadata url. This assumption will work in most common cases but can have significant side effects otherwise.

Conversion implementation breaks encapsulation and violates PSR-7 contract. Just looking at current Diactoros, it would break when Stream object holds a non-stream resource, resource is not rewindable and/or rewindable with Stream internal read cache, for RelativeStream, and when Stream holds a network socket in pass-through scenario.

All body/stream conversions are suspect and warrant a closer look.

I think the only sensible solution here is to always read StreamInterface object in chunks and write to php://temp stream. This would potentially create significant performance overhead.

Current behavior

laminas-psr7bridge/src/Psr7Response.php

Line 26 in e8ab789

$uri = $psr7Response->getBody()->getMetadata('uri');

laminas-psr7bridge/src/Psr7Response.php

Line 45 in e8ab789

$response->setStream(fopen($uri, 'rb'));

How to reproduce

Expected behavior

Any StreamInterface implementation is safely copied.