Skip to content

fix: ignore media ranges without a subtype in Negotiate::media() - #10660

Open
wleeaf wants to merge 1 commit into
codeigniter4:developfrom
wleeaf:negotiate-media-range-without-subtype
Open

wleeaf wants to merge 1 commit into
codeigniter4:developfrom
wleeaf:negotiate-media-range-without-subtype

Conversation

@wleeaf

@wleeaf wleeaf commented Oct 25, 2026

Copy link
Copy Markdown

Description
Negotiate::matchTypes() splits each value on / and reads the subtype without checking that one exists. So media() throws ErrorException: Undefined array key 1 when the Accept header holds a value without a subtype, such as json, or an empty list element (Accept: , text/html). That value is compared with every supported type before the next header value is reached, which means the exception happens even when a later value in the header would match.

matchTypes() now returns false when either value has no /. A value like that is not a media type, so Accept: json, application/json now resolves to application/json. Headers that were already handled return the same results.

testBestMatchIgnoresMediaRangesWithoutSubtype in tests/system/HTTP/NegotiateTest.php covers both inputs. Without the change it fails with ErrorException: Undefined array key 1. The v4.7.6 changelog has a Bugs Fixed entry.

tests/system/HTTP/ passes. php-cs-fixer, PHPStan and Rector (dry run) report nothing for the changed files.

Checklist:

  • Securely signed commits
  • Component(s) with PHPDoc blocks, only if necessary or adds value (without duplication)
  • Unit testing, with >80% coverage
  • User guide updated
  • Conforms to style guide

`Negotiate::matchTypes()` split each value on "/" and read the subtype
without checking that there was one, so an `Accept` header with a value
such as "json", or an empty list element, threw an `ErrorException`
("Undefined array key 1"). Such values are not media types and now do not
match.
@carson-codeigniter4 carson-codeigniter4 Bot added the bug Verified issues on the current code behavior or pull requests that will fix them label Oct 25, 2026
@carson-codeigniter4

Copy link
Copy Markdown

Hi there, @wleeaf! 👋

Thank you for sending this PR!

We expect the following in all Pull Requests (PRs).

Important

We expect all code changes or bug-fixes to be accompanied by one or more tests added to our test suite to prove the code works.

If pull requests do not comply with the above, they will likely be closed. Since we are a team of volunteers, we don't have any more time to work
on the framework than you do. Please make it as painless for your contributions to be included as possible.

See https://github.com/codeigniter4/CodeIgniter4/blob/develop/contributing/pull_request.md

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Verified issues on the current code behavior or pull requests that will fix them

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant