bug #19321 [HttpFoundation] Add OPTIONS and TRACE to the list of safe…

… methods (dunglas) This PR was squashed before being merged into the 2.7 branch (closes #19321). Discussion ---------- [HttpFoundation] Add OPTIONS and TRACE to the list of safe methods | Q | A | ------------- | --- | Branch? | 2.7 | Bug fix? | yes | New feature? | no | BC breaks? | no | Deprecations? | no | Tests pass? | yes | Fixed tickets | n/a | License | MIT | Doc PR | n/a According to [RFC 7231](https://tools.ietf.org/html/rfc7231#section-8.1.3) `OPTIONS` and `TRACE` are safe methods. Commits ------- 1404607 [HttpFoundation] Add OPTIONS and TRACE to the list of safe methods
symfony · Jul 10, 2016 · 500c2cd · 500c2cd
2 parents 8b6d74e + 1404607
commit 500c2cd
Show file tree

Hide file tree

Showing 2 changed files with 27 additions and 1 deletion.
diff --git a/src/Symfony/Component/HttpFoundation/Request.php b/src/Symfony/Component/HttpFoundation/Request.php
@@ -1470,7 +1470,7 @@ public function isMethod($method)
      */
     public function isMethodSafe()
     {
-        return in_array($this->getMethod(), array('GET', 'HEAD'));
+        return in_array($this->getMethod(), array('GET', 'HEAD', 'OPTIONS', 'TRACE'));
     }
 
     /**

diff --git a/src/Symfony/Component/HttpFoundation/Tests/RequestTest.php b/src/Symfony/Component/HttpFoundation/Tests/RequestTest.php
@@ -1912,6 +1912,32 @@ public function getLongHostNames()
             array(str_repeat(':', 101)),
         );
     }
+
+    /**
+     * @dataProvider methodSafeProvider
+     */
+    public function testMethodSafe($method, $safe)
+    {
+        $request = new Request();
+        $request->setMethod($method);
+        $this->assertEquals($safe, $request->isMethodSafe());
+    }
+
+    public function methodSafeProvider()
+    {
+        return array(
+            array('HEAD', true),
+            array('GET', true),
+            array('POST', false),
+            array('PUT', false),
+            array('PATCH', false),
+            array('DELETE', false),
+            array('PURGE', false),
+            array('OPTIONS', true),
+            array('TRACE', true),
+            array('CONNECT', false),
+        );
+    }
 }
 
 class RequestContentProxy extends Request