[HttpFoundation] Ensure path info has a leading slash

[alexpott]

Q	A
Branch?	4.4
Bug fix?	yes
New feature?	no
Deprecations?	no
Tickets	Fix #...
License	MIT
Doc PR	symfony/symfony-docs#...

On a Drupal 8/9 site if you make a request for /index.php.php then this will cause PHP notices. The default .htaccess rule shipped with Drupal does not redirect from /index.php to / if it did that the path would be /.php and it would correctly 404. However changing the Drupal .htaccess rule to behave like https://github.com/symfony/recipes-contrib/blob/master/symfony/apache-pack/1.0/public/.htaccess suggests is fraught and would probably not fix existing sites.

Already in \Symfony\Component\HttpFoundation\Request::preparePathInfo() we ensure that it starts with a leading slash if \Symfony\Component\HttpFoundation\Request::getBaseUrlReal() returns NULL and I think we should do the same if strip the base url from the request URI.

See https://www.drupal.org/project/drupal/issues/3167426 for more information on the bugs this is causing in Drupal.

[stof]

that case looks wrong to me though, as that would be a different Uri that the input

[alexpott]

What should the uri be though? If you make a request to index.php/something or /something in this situation you'd want the path info to be /something. And it is. I think this is a special edge case because of the way htaccess rules work for Drupal (and probably a number of other projects). The relevant parts of our rule is:

 RewriteCond %{REQUEST_FILENAME} !-f RewriteCond %{REQUEST_FILENAME} !-d RewriteCond %{REQUEST_URI} !=/favicon.ico RewriteRule ^ index.php [L] 

I think we should treat a request to index.phpSOMETHING as a request to SOMETHING - regardless of whether SOMETHING starts with a /... which means we need to duplicate the logic of when there is no base path...

This is just above the code I've added.

 if ('' !== $requestUri && '/' !== $requestUri[0]) { $requestUri = '/'.$requestUri; } if (null === ($baseUrl = $this->getBaseUrl())) { return $requestUri; } 

[stof]

For index.php/something, It totally agree. But this is not what this test is covering.

[Nyholm]

How would I be able to detect the difference between the following URLs:

https://example.com/ https://example.com 

?

[alexpott]

How would I be able to detect the difference between the following URLs:

https://example.com/ https://example.com 

?

This is unaffected as far as I can see. Here's the preceding code which is going to deal with this case...

 if ('' !== $requestUri && '/' !== $requestUri[0]) { $requestUri = '/'.$requestUri; } if (null === ($baseUrl = $this->getBaseUrl())) { return $requestUri; } $pathInfo = substr($requestUri, \strlen($baseUrl)); if (false === $pathInfo || '' === $pathInfo) { // If substr() returns false then PATH_INFO is set to an empty string return '/'; } 

[xabbuh]

Would this fix #37995?

[alexpott]

@xabbuh I was wondering that too but I think the question you asked in #37995 (comment) is key there. I'm not sure how you end up with "SCRIPT_NAME" => "index.php", and not "SCRIPT_NAME" => "/index.php",

[alexpott]

@stof what do I need to do to get this one fixed?