Zend/Http/Header/AbstractAccept throws php notice when "HTTP_ACCEPT_LANGUAGE" is non well formatted

[neilime]

Hi,

An error occured when we try to retrieve "Accept-Language" from request headers and "$_SERVER['HTTP_ACCEPT_LANGUAGE']" is non well formatted : ""Undefined offset: 1" - /.../Zend/Http/Header/AbstractAccept.php (173)"

The following unit test shows this behavior.

    public function testDefineDefaultLocaleWithWrongHttpAcceptLanguageHeader()
    {
        $_SERVER['HTTP_ACCEPT_LANGUAGE'] = 'en-US;en';
        $oRequest = new \Zend\Http\PhpEnvironment\Request();
        $oRequest->getHeaders()->get('Accept-Language'); // Php notice
    }

Thanks for helping me to fix it

[Freeaqingme]

@neilime Thanks for your report!

Out of curiosity, have you seen this behavior in production, or is it just a hypothetical case?

Have you been able to come up with a fix? For this particular issue I'd say we could ignore any parameter that doesn't contain a key=value pair. We could add an if statement that checks whether $explode contains a total of 2 elements, and if not continue so that it iterates to the parameter.

Thoughts?

[neilime]

@Freeaqingme, yes we have seen this bug in production so we have to fix it, here is the diff :

@@ -182,18 +182,20 @@ abstract class AbstractAccept implements HeaderInterface
             }

             foreach ($paramsStrings as $param) {
-                $explode = explode('=', $param, 2);
+                if (strpos($param, '=') !== false) {
+                    $explode = explode('=', $param, 2);

-                if (isset($explode[1])) {
-                    $value = trim($explode[1]);
-                    if (isset($value[0]) && $value[0] == '"' && substr($value, -1) == '"') {
-                        $value = substr(substr($value, 1), 0, -1);
+                    if (isset($explode[1])) {
+                        $value = trim($explode[1]);
+                        if (isset($value[0]) && $value[0] == '"' && substr($value, -1) == '"') {
+                            $value = substr(substr($value, 1), 0, -1);
+                        }
+                    } else {
+                        throw new \LogicException('Undefined offset in parameter: ' . $fieldValuePart);
                     }

-                $params[trim($explode[0])] = stripslashes($value);
+                    $params[trim($explode[0])] = stripslashes($value);
+                }
             }
         }

[Maks3w]

Could you send a Pull Request with your patch and test? Just change:

if (strpos($param, '=') !== false) {
 // bla bla bla
}

with

if (strpos($param, '=') === false) {
  continue;
}
// bla bla bla

[Freeaqingme]

@neilime On top of what @Maks3w already said, maybe you could also try to add a unit test that tests for this specific issue. That way you can be sure this issue won't be reintroduced.

If you encounter any difficulties, feel free to poke me on IRC ( http://www.zendframework.com/irc/ ).

[neilime]

Ok guys I will submit a PR when I will have time to do it. Lets say tomorrow morning.

[Maks3w]

Sorry but the header value en-US;en is malformed. Should be en-US,en. Could you facilitate more details about the environment?

• The exact header sent by the HTTP Client
• The PHP SAPI (apache, cgi, ...)
• PHP version

[Freeaqingme]

@Maks3w I don't think it's much of a server side issue, it's just some damn clients that aren't able to adhere to the RFC's. The webserver/SAPI don't ascribe any special meaning to these headers, they''re just handled as strings. Until it reaches Zend\Http...

[Maks3w]

I don't think too but I prefer ask those things at the same time and avoid ask again.

If the HTTP client is enough relevant we could consider apply adhoc code.

[Maks3w]

Closed due inactivity.