Skip to content

Fix gh-5270: Clarify request_parse_body behavior with consumed body#5412

Open
jordikroon wants to merge 1 commit intophp:masterfrom
jordikroon:fix/gh-5270
Open

Fix gh-5270: Clarify request_parse_body behavior with consumed body#5412
jordikroon wants to merge 1 commit intophp:masterfrom
jordikroon:fix/gh-5270

Conversation

@jordikroon
Copy link
Copy Markdown
Contributor

Fixes #5270

@jordikroon jordikroon changed the title Clarify request_parse_body behavior with consumed body Fix gh-5270: Clarify request_parse_body behavior with consumed body Mar 6, 2026
@lacatoire
Copy link
Copy Markdown
Member

lacatoire commented Apr 5, 2026

Both code paths in urlencoded and multipart call sapi_module.read_post() with no guard against a previously consumed input stream. Once php://input has been read, the SAPI socket is drained and request_parse_body() gets nothing.

Two concerns with the current wording:

  1. "may no longer be available", the behavior is deterministic, not conditional. If the body was consumed, request_parse_body() will return empty arrays.
  2. "the raw input stream", is a bit vague. What's gone is the body data, not the stream itself.

a way to cover both would be:

  <caution>
   <simpara>
    The request body can only be consumed once.
    <function>request_parse_body</function> consumes the request body without
    buffering it to the <literal>php://input</literal> stream.
    Conversely, if the body has already been read (e.g. via
    <literal>php://input</literal>), <function>request_parse_body</function>
    will return empty data.
   </simpara>
  </caution>

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Request_parse_body returns nothing when something has accessed php://input stream before it

2 participants