[HttpFoundation] Add OPTIONS and TRACE to the list of safe methods

dunglas · fabpot · commit 140460707201 · 2016-07-10T11:40:48.000+02:00
diff --git a/src/Symfony/Component/HttpFoundation/Request.php b/src/Symfony/Component/HttpFoundation/Request.php
@@ -1470,7 +1470,7 @@ public function isMethod($method)
      */
     public function isMethodSafe()
     {
-        return in_array($this->getMethod(), array('GET', 'HEAD'));
+        return in_array($this->getMethod(), array('GET', 'HEAD', 'OPTIONS', 'TRACE'));
     }
 
     /**
diff --git a/src/Symfony/Component/HttpFoundation/Tests/RequestTest.php b/src/Symfony/Component/HttpFoundation/Tests/RequestTest.php
@@ -1912,6 +1912,32 @@ public function getLongHostNames()
             array(str_repeat(':', 101)),
         );
     }
+
+    /**
+     * @dataProvider methodSafeProvider
+     */
+    public function testMethodSafe($method, $safe)
+    {
+        $request = new Request();
+        $request->setMethod($method);
+        $this->assertEquals($safe, $request->isMethodSafe());
+    }
+
+    public function methodSafeProvider()
+    {
+        return array(
+            array('HEAD', true),
+            array('GET', true),
+            array('POST', false),
+            array('PUT', false),
+            array('PATCH', false),
+            array('DELETE', false),
+            array('PURGE', false),
+            array('OPTIONS', true),
+            array('TRACE', true),
+            array('CONNECT', false),
+        );
+    }
 }
 
 class RequestContentProxy extends Request

Original file line number	Diff line number	Diff line change
`@@ -1470,7 +1470,7 @@ public function isMethod($method)`
`1470`	`1470`	`*/`
`1471`	`1471`	`public function isMethodSafe()`
`1472`	`1472`	`{`
`1473`		`- return in_array($this->getMethod(), array('GET', 'HEAD'));`
	`1473`	`+ return in_array($this->getMethod(), array('GET', 'HEAD', 'OPTIONS', 'TRACE'));`
`1474`	`1474`	`}`
`1475`	`1475`
`1476`	`1476`	`/**`