diff --git a/src/Http/RequestFactory.php b/src/Http/RequestFactory.php index efd9d560..797ebd8f 100644 --- a/src/Http/RequestFactory.php +++ b/src/Http/RequestFactory.php @@ -69,7 +69,8 @@ public function createHttpRequest() $url->setPassword(isset($_SERVER['PHP_AUTH_PW']) ? $_SERVER['PHP_AUTH_PW'] : ''); // host & port - if ((isset($_SERVER[$tmp = 'HTTP_HOST']) || isset($_SERVER[$tmp = 'SERVER_NAME'])) + if ( + (isset($_SERVER[$tmp = 'HTTP_HOST']) || isset($_SERVER[$tmp = 'SERVER_NAME'])) && preg_match('#^([a-z0-9_.-]+|\[[a-f0-9:]+\])(:\d+)?\z#i', $_SERVER[$tmp], $pair) ) { $url->setHost(strtolower($pair[1])); @@ -135,7 +136,9 @@ public function createHttpRequest() $list = []; if (!empty($_FILES)) { foreach ($_FILES as $k => $v) { - if (!is_array($v) || !isset($v['name'], $v['type'], $v['size'], $v['tmp_name'], $v['error']) + if ( + !is_array($v) + || !isset($v['name'], $v['type'], $v['size'], $v['tmp_name'], $v['error']) || (!$this->binary && is_string($k) && (!preg_match($reChars, $k) || preg_last_error())) ) { continue; @@ -266,7 +269,9 @@ public function createHttpRequest() // method, eg. GET, PUT, ... $method = isset($_SERVER['REQUEST_METHOD']) ? $_SERVER['REQUEST_METHOD'] : null; - if ($method === 'POST' && isset($_SERVER['HTTP_X_HTTP_METHOD_OVERRIDE']) + if ( + $method === 'POST' + && isset($_SERVER['HTTP_X_HTTP_METHOD_OVERRIDE']) && preg_match('#^[A-Z]+\z#', $_SERVER['HTTP_X_HTTP_METHOD_OVERRIDE']) ) { $method = $_SERVER['HTTP_X_HTTP_METHOD_OVERRIDE']; diff --git a/src/Http/Response.php b/src/Http/Response.php index 457dba78..8f0da33d 100644 --- a/src/Http/Response.php +++ b/src/Http/Response.php @@ -240,7 +240,10 @@ public static function date($time = null) public function __destruct() { - if (self::$fixIE && isset($_SERVER['HTTP_USER_AGENT']) && strpos($_SERVER['HTTP_USER_AGENT'], 'MSIE ') !== false + if ( + self::$fixIE + && isset($_SERVER['HTTP_USER_AGENT']) + && strpos($_SERVER['HTTP_USER_AGENT'], 'MSIE ') !== false && in_array($this->code, [400, 403, 404, 405, 406, 408, 409, 410, 500, 501, 505], true) && preg_match('#^text/html(?:;|$)#', $this->getHeader('Content-Type')) ) {