php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #61679 Error on non-standard HTTP methods
Submitted: 2012-04-09 13:47 UTC Modified: 2012-09-18 20:22 UTC
Votes:6
Avg. Score:3.0 ± 1.0
Reproduced:3 of 3 (100.0%)
Same Version:1 (33.3%)
Same OS:1 (33.3%)
From: toby@php.net Assigned: laruence
Status: Closed Package: Built-in web server
PHP Version: 5.4.0 OS: Linux
Private report: No CVE-ID:
 [2012-04-09 13:47 UTC] toby@php.net
Description:
------------
The built in webserver bails out with an error on retrieval of a non-standard HTTP request method (e.g. PATCH).

Test script:
---------------
Run the PHP built in web server on PORT 8042 and use the following script to reproduce the error:

$httpFilePointer = fopen(                                                       
    'http://localhost:8042',                                                    
    'r',                                                                        
    false,                                                                      
    stream_context_create(                                                      
        array(                                                                  
            'http' => array(                                                    
                'method'        => 'PATCH',                                     
            ),                                                                  
        )                                                                       
    )                                                                           
);

Expected result:
----------------
A valid HTTP response, depending on the script run by the server.

Actual result:
--------------
The server logs to shell:

[Mon Apr  9 15:45:35 2012] ::1:37726 Invalid request (Malformed HTTP request)

The client complains about a malformed response:

Warning: fopen(http://localhost:8042): failed to open stream: HTTP request failed!  in …



Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2012-04-09 13:58 UTC] laruence@php.net
hmm, I will try to fix it when I find what will apache does in such case :)
 [2012-04-09 13:58 UTC] laruence@php.net
-Assigned To: +Assigned To: laruence
 [2012-04-09 13:58 UTC] toby@php.net
-Status: Assigned +Status: Open
 [2012-04-09 13:58 UTC] toby@php.net
Just to make this clear: HTTP allows arbitrary method verbs to be used. Quoting the EBNF from RFC 2616, chapter 5.1.1:

Method         = "OPTIONS"                ; Section 9.2                         
               | "GET"                    ; Section 9.3                         
…
               | extension-method                                               
extension-method = token

Event if the server itself does not support a certain method, it should not crash, but send a 405 (Method Not Allowed) response. However, for the built in web server, it makes sense to let the executed script handle this and pipe arbitrary method verbs to it.
 [2012-04-10 04:39 UTC] laruence@php.net
-Status: Open +Status: Assigned
 [2012-09-18 20:22 UTC] lstrojny@php.net
-Status: Assigned +Status: To be documented
 [2012-09-18 20:22 UTC] lstrojny@php.net
The fix for this bug has been committed.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.

GitHub PR #190 (https://github.com/php/php-src/pull/190) merged into 5.4 and 
master.
 
PHP Copyright © 2001-2014 The PHP Group
All rights reserved.
Last updated: Sun Apr 20 19:01:51 2014 UTC