Fix: Return empty content for multipart requests to match PHP-FPM behavior#119
Fix: Return empty content for multipart requests to match PHP-FPM behavior#119
Conversation
09a91c0 to
6c1e0dc
Compare
src/DTO/RequestConverter.php
Outdated
| // JSON and other content types should leave POST bag empty (like PHP-FPM) | ||
| $contentType = $rawRequest->header('content-type', ''); | ||
| $isFormData = preg_match('/^(application\/x-www-form-urlencoded|multipart\/form-data)\b/i', (string) $contentType); | ||
| $isFormUrlEncoded = stripos((string) $contentType, 'application/x-www-form-urlencoded') !== false; |
There was a problem hiding this comment.
[Suggestion] stripos() matches the substring anywhere in the string, whereas the original preg_match used ^ (start anchor) and \b (word boundary). In practice false positives are extremely unlikely, but this is a behavioral regression from stricter to looser matching.
Consider using str_starts_with() to preserve the original anchored behavior:
| $isFormUrlEncoded = stripos((string) $contentType, 'application/x-www-form-urlencoded') !== false; | |
| $ct = strtolower((string) $rawRequest->header('content-type', '')); | |
| $isFormUrlEncoded = str_starts_with($ct, 'application/x-www-form-urlencoded'); | |
| $isMultipart = str_starts_with($ct, 'multipart/form-data'); |
— coder-model via Qwen Code /review
|
|
||
| // For multipart requests, pass empty content to match PHP-FPM behavior | ||
| // (php://input is not available for multipart - body is consumed during $_POST/$_FILES parsing) | ||
| $content = $isMultipart ? '' : $rawRequest->rawBody(); |
There was a problem hiding this comment.
[Suggestion] Before this change, getContent() on a multipart request returned the full raw body. Now it returns ''. Any application code, middleware, or custom parser reading raw multipart data will silently break.
The behavior is correct for PHP-FPM compatibility, but this should be documented as a breaking change in CHANGELOG.md with a migration note so existing users are aware.
— coder-model via Qwen Code /review
…avior For multipart/form-data requests, getContent() now returns empty string to match PHP-FPM behavior where php://input is not available. This prevents: - Duplicate memory usage (file data stored twice) - Data exposure via getContent() logging - Behavioral inconsistency with PHP-FPM Also improves content-type detection using stripos() instead of preg_match().
6c1e0dc to
750544f
Compare
Summary
For multipart/form-data requests,
getContent()now returns empty string to match PHP-FPM behavior wherephp://inputis not available.Changes
RequestConverter::toSymfonyRequest()to pass empty content for multipart requestsstripos()instead ofpreg_match()Benefits
getContent()Testing
Closes #68