Environment variables prefixed with `CONTENT_` may overwrite HTTP-Headers provided by the client about laminas-diactoros HOT 3 CLOSED

If my understanding of https://tools.ietf.org/html/rfc3875#section-4.1.2 is correct only CONTENT_LENGTH and CONTENT_TYPE should be copied from $_SERVER to the headers in https://github.com/laminas/laminas-diactoros/blob/2.5.1/src/functions/marshal_headers_from_sapi.php#L54

Edit:
And maybe CONTENT_MD5, see: https://github.com/ralouphie/getallheaders/blob/develop/src/getallheaders.php#L14

from laminas-diactoros.

I agree we should make these changes.

Primary issue is... the MarshalHeadersFromSapiTest has a few test cases that fail if I make this change, as it was explicitly testing that things like CONTENT_FOO and CONTENT_BAZ in the $_SERVER array were being converted to headers. As such, this is potentially a BC break, as we'd be changing existing behavior.

I'm going to ask the TSC if the change can be done in next minor (2.6.0) as I'd call the current behavior incorrect, or if we absolutely need to do a new major (3.0.0).

from laminas-diactoros.

One suggestion by @boesing is to potentially add a feature flag that is toggled via an ENV variable, and have it default to existing behavior when not present. This would allow you to opt-in to the new behavior, while keeping it backwards compatible by default. Next major version would remove the bad behavior of the current version.

I'll start work on that shortly.

from laminas-diactoros.