Skip to content
Permalink
Browse files

[HttpFoundation] reject invalid method override

  • Loading branch information
nicolas-grekas authored and michaelcullum committed Apr 16, 2019
1 parent b7bdf2c commit 944e60f083c3bffbc6a0b5112db127a10a66a8ec
Showing with 29 additions and 14 deletions.
  1. +29 −14 src/Symfony/Component/HttpFoundation/Request.php
@@ -1346,22 +1346,37 @@ public function setMethod($method)
*/
public function getMethod()
{
if (null === $this->method) {
$this->method = strtoupper($this->server->get('REQUEST_METHOD', 'GET'));

if ('POST' === $this->method) {
if ($method = $this->headers->get('X-HTTP-METHOD-OVERRIDE')) {
$this->method = strtoupper($method);
} elseif (self::$httpMethodParameterOverride) {
$method = $this->request->get('_method', $this->query->get('_method', 'POST'));
if (\is_string($method)) {
$this->method = strtoupper($method);
}
}
}
if (null !== $this->method) {
return $this->method;
}

$this->method = strtoupper($this->server->get('REQUEST_METHOD', 'GET'));

if ('POST' !== $this->method) {
return $this->method;
}

$method = $this->headers->get('X-HTTP-METHOD-OVERRIDE');

if (!$method && self::$httpMethodParameterOverride) {
$method = $this->request->get('_method', $this->query->get('_method', 'POST'));
}

if (!\is_string($method)) {
return $this->method;
}

$method = strtoupper($method);

if (\in_array($method, ['GET', 'HEAD', 'POST', 'PUT', 'DELETE', 'CONNECT', 'OPTIONS', 'PATCH', 'PURGE', 'TRACE'], true)) {
return $this->method = $method;
}

if (!preg_match('/^[A-Z]++$/D', $method)) {
throw new SuspiciousOperationException(sprintf('Invalid method override "%s".', $method));
}

return $this->method;
return $this->method = $method;
}

/**

1 comment on commit 944e60f

@jirayutza1

This comment has been minimized.

Copy link

@jirayutza1 jirayutza1 commented on 944e60f Dec 4, 2019

Please sign in to comment.
You can’t perform that action at this time.