From 10cc4183453331575ec4ee223ff2f305d3220bd2 Mon Sep 17 00:00:00 2001
From: Matthias Vogel <m.vogel@andersundsehr.com>
Date: Mon, 12 Oct 2026 10:26:51 +0000
Subject: [PATCH] test: verify large HTTP request bodies reach PHP intact

---
 tests/serverspec/conf/app/php-test.php      |  5 +++++
 tests/serverspec/spec/collection/php-fpm.rb |  2 ++
 tests/serverspec/spec/shared/php/test.rb    | 25 +++++++++++++++++++++
 3 files changed, 32 insertions(+)

diff --git a/tests/serverspec/conf/app/php-test.php b/tests/serverspec/conf/app/php-test.php
index 19d3b5a58..a605dcc8d 100644
--- a/tests/serverspec/conf/app/php-test.php
+++ b/tests/serverspec/conf/app/php-test.php
@@ -5,6 +5,11 @@
         echo sha1('webdevops');
         break;
 
+    case 'request_body':
+        $body = file_get_contents('php://input');
+        echo strlen($body), ':', hash('sha256', $body);
+        break;
+
     case 'version':
         echo 'PHP ' . phpversion();
         break;
diff --git a/tests/serverspec/spec/collection/php-fpm.rb b/tests/serverspec/spec/collection/php-fpm.rb
index 45cd91a68..1983d609d 100644
--- a/tests/serverspec/spec/collection/php-fpm.rb
+++ b/tests/serverspec/spec/collection/php-fpm.rb
@@ -26,6 +26,7 @@
     include_examples 'php-fpm::versioned::modules'
     include_examples 'php-fpm::modules::development'
     include_examples 'php::fpm::test::sha1'
+    include_examples 'php::fpm::test::large_body'
     include_examples 'php::fpm::test::php_ini_scanned_files'
     include_examples 'php::fpm::test::php_sapi_name'
     include_examples 'php::fpm::test::process_user_id'
@@ -38,6 +39,7 @@
     include_examples 'php-fpm::versioned::modules'
     include_examples 'php-fpm::modules::production'
     include_examples 'php::fpm::test::sha1'
+    include_examples 'php::fpm::test::large_body'
     include_examples 'php::fpm::test::php_ini_scanned_files'
     include_examples 'php::fpm::test::php_sapi_name'
     include_examples 'php::fpm::test::process_user_id'
diff --git a/tests/serverspec/spec/shared/php/test.rb b/tests/serverspec/spec/shared/php/test.rb
index 45a50fa39..81c65e974 100644
--- a/tests/serverspec/spec/shared/php/test.rb
+++ b/tests/serverspec/spec/shared/php/test.rb
@@ -1,3 +1,5 @@
+require 'digest'
+
 shared_examples 'php::cli::test::sha1' do
     describe command('php -r \'echo sha1("webdevops");\'') do
         its(:stdout) { should_not contain('PHP Notice') }
@@ -152,3 +154,26 @@
         end
     end
 end
+
+shared_examples 'php::fpm::test::large_body' do
+    ['http', 'https'].each do |scheme|
+        describe "#{scheme} large request body" do
+            it "should receive a 1 MiB body intact", :retry => 20, :retry_wait => 3 do
+                body_size = 1024 * 1024
+                checksum = Digest::SHA256.hexdigest("\0" * body_size)
+                cmd = command(<<-SH)
+                    set -eu
+                    payload=$(mktemp)
+                    trap 'rm -f "$payload"' EXIT
+                    head -c #{body_size} /dev/zero > "$payload"
+                    curl --insecure --silent --show-error --fail --max-time 15 \
+                        -H 'Content-Type: application/octet-stream' \
+                        --data-binary @"$payload" \
+                        '#{scheme}://localhost/php-test.php?test=request_body'
+                SH
+                expect(cmd.exit_status).to eq 0
+                expect(cmd.stdout).to eq "#{body_size}:#{checksum}"
+            end
+        end
+    end
+end