When querying a site that returned a header of "HTTP/1.1 404" without giving a text status, drupal_http_request triggered a notice.

The standard (RFC #2616) is unclear on whether the phrase is required (it seems empty phrases are accepted). In any case, the function should be notice-safe regardless of the remote server's response.

Comments

cburschka’s picture

Status: Active » Needs review
StatusFileSize
new811 bytes

This patch pads the array to length 3 before putting it into the three variables.

dries’s picture

Status: Needs review » Needs work

- I'd recommend that we use slightly more readable code. It's OK if the code is slightly more verbose, but at least, it would be a bit easier to grok.

- I'd recommend that we submit a SimpleTest to go with this.

cburschka’s picture

I understand what you mean, but I'm not sure how to do this elegantly.

The problem goes beyond simply making sure the code is notice-free; it's also about sanitizing the response. Since the function is a pretty complete implementation of an HTTP client, it should deal with the possibility that the server response violates the protocol, preferably without crashing and burning.

For now, this is the best I can come up with. It assumes that the required fields are present, but not the optional field - if the server really messes up for whatever reason, the code will trigger notices:

  // Status line consists of HTTP version, 3-digit response code and optional message.
  $status_line = explode(' ', trim(array_shift($split)), 3);
  list($protocol, $status) = $status_line;
  $text = count($status_line) > 2 ? $status_line[2] : '';

The comment would go a good way to making the code understandable there.

(The alternative is to make a really strict regular expression - /^(HTTP\/[0-9]+\.[0-9]+) ([0-9]{3,3})( (.*))?$/ and break the connection on a mis-match. I don't like expressions unless they're needed.)

dave reid’s picture

dave reid’s picture

Status: Needs work » Closed (duplicate)