minor #62065 [FrameworkBundle][HttpFoundation] forbid HTTP method override of GET, HEAD, CONNECT and TRACE (xabbuh)

nicolas-grekas · nicolas-grekas · commit 905f61c7d3fc · 2025-10-14T12:57:50.000+02:00
This PR was merged into the 7.4 branch. Discussion ---------- [FrameworkBundle][HttpFoundation] forbid HTTP method override of GET, HEAD, CONNECT and TRACE | Q | A | ------------- | --- | Branch? | 7.4 | Bug fix? | no | New feature? | no | Deprecations? | no | Issues | see #62042 (comment) | License | MIT Commits ------- 1b79380 forbid HTTP method override of GET, HEAD, CONNECT and TRACE
diff --git a/src/Symfony/Bundle/FrameworkBundle/DependencyInjection/Configuration.php b/src/Symfony/Bundle/FrameworkBundle/DependencyInjection/Configuration.php
@@ -98,6 +98,10 @@ public function getConfigTreeBuilder(): TreeBuilder
                     ->info('Sets the list of HTTP methods that can be overridden. Set to null to allow all methods to be overridden (default). Set to an empty array to disallow overrides entirely. Otherwise, provide the list of uppercased method names that are allowed.')
                     ->stringPrototype()->end()
                     ->defaultNull()
+                    ->validate()
+                        ->ifTrue(static fn ($v) => array_intersect($v, ['GET', 'HEAD', 'CONNECT', 'TRACE']))
+                        ->thenInvalid('The HTTP methods "GET", "HEAD", "CONNECT", and "TRACE" cannot be overridden.')
+                    ->end()
                 ->end()
                 ->scalarNode('trust_x_sendfile_type_header')
                     ->info('Set true to enable support for xsendfile in binary file responses.')
diff --git a/src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/ConfigurationTest.php b/src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/ConfigurationTest.php
@@ -13,6 +13,7 @@
 
 use Doctrine\DBAL\Connection;
 use PHPUnit\Framework\Attributes\DataProvider;
+use PHPUnit\Framework\Attributes\TestWith;
 use PHPUnit\Framework\TestCase;
 use Symfony\Bundle\FrameworkBundle\DependencyInjection\Configuration;
 use Symfony\Bundle\FullStack;
@@ -711,6 +712,25 @@ public function testFormCsrfProtectionFieldAttrDoNotNormalizeKeys()
         $this->assertSame(['data-example-attr' => 'value'], $config['form']['csrf_protection']['field_attr'] ?? []);
     }
 
+    #[TestWith(['CONNECT'])]
+    #[TestWith(['GET'])]
+    #[TestWith(['HEAD'])]
+    #[TestWith(['TRACE'])]
+    public function testInvalidHttpMethodOverride(string $method)
+    {
+        $processor = new Processor();
+
+        $this->expectException(InvalidConfigurationException::class);
+        $this->expectExceptionMessage('The HTTP methods "GET", "HEAD", "CONNECT", and "TRACE" cannot be overridden.');
+
+        $processor->processConfiguration(
+            new Configuration(true),
+            [[
+                'allowed_http_method_override' => [$method],
+            ]]
+        );
+    }
+
     protected static function getBundleDefaultConfig()
     {
         return [
diff --git a/src/Symfony/Component/HttpFoundation/Request.php b/src/Symfony/Component/HttpFoundation/Request.php
@@ -698,6 +698,10 @@ public static function getHttpMethodParameterOverride(): bool
      */
     public static function setAllowedHttpMethodOverride(?array $methods): void
     {
+        if (array_intersect($methods ?? [], ['GET', 'HEAD', 'CONNECT', 'TRACE'])) {
+            throw new \InvalidArgumentException('The HTTP methods "GET", "HEAD", "CONNECT", and "TRACE" cannot be overridden.');
+        }
+
         self::$allowedHttpMethodOverride = $methods;
     }
 
diff --git a/src/Symfony/Component/HttpFoundation/Tests/RequestTest.php b/src/Symfony/Component/HttpFoundation/Tests/RequestTest.php
@@ -300,6 +300,17 @@ public function testHttpMethodOverrideRespectsAllowedListWithParameter()
         }
     }
 
+    #[TestWith(['CONNECT'])]
+    #[TestWith(['GET'])]
+    #[TestWith(['HEAD'])]
+    #[TestWith(['TRACE'])]
+    public function testHttpMethodOverrideCannotBeAppliedToCertainMethods(string $httpOverrideMethod)
+    {
+        $this->expectException(\InvalidArgumentException::class);
+
+        Request::setAllowedHttpMethodOverride([$httpOverrideMethod]);
+    }
+
     public function testCreateWithRequestUri()
     {
         $request = Request::create('http://test.com:80/foo');
