When querying a site that returned a header of "HTTP/1.1 404" without giving a text status, drupal_http_request triggered a notice.
The standard (RFC #2616) is unclear on whether the phrase is required (it seems empty phrases are accepted). In any case, the function should be notice-safe regardless of the remote server's response.
| Comment | File | Size | Author |
|---|---|---|---|
| #1 | common-http-request-notice-273994-1.patch | 811 bytes | cburschka |
Comments
Comment #1
cburschkaThis patch pads the array to length 3 before putting it into the three variables.
Comment #2
dries commented- I'd recommend that we use slightly more readable code. It's OK if the code is slightly more verbose, but at least, it would be a bit easier to grok.
- I'd recommend that we submit a SimpleTest to go with this.
Comment #3
cburschkaI understand what you mean, but I'm not sure how to do this elegantly.
The problem goes beyond simply making sure the code is notice-free; it's also about sanitizing the response. Since the function is a pretty complete implementation of an HTTP client, it should deal with the possibility that the server response violates the protocol, preferably without crashing and burning.
For now, this is the best I can come up with. It assumes that the required fields are present, but not the optional field - if the server really messes up for whatever reason, the code will trigger notices:
The comment would go a good way to making the code understandable there.
(The alternative is to make a really strict regular expression -
/^(HTTP\/[0-9]+\.[0-9]+) ([0-9]{3,3})( (.*))?$/and break the connection on a mis-match. I don't like expressions unless they're needed.)Comment #4
dave reidMarking as a duplicate of #205969: drupal_http_request() assumes presence of Reason-Phrase in response Status-Line.
Comment #5
dave reid