Add support for adjusting binary detection regex in FullHttpMessageFormatter

Regrettably, in our applications, php serialize() is often used instead of JSON as a serialization format used over wire. Instead of changing ∂efault regex for everyone (which could be a security risk in case target endpoint is untrusted), this allows to inject custom regex.

Author: ostrolucky

CHANGELOG.md

@@ -6,6 +6,10 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/)
 and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.html).
 
+## [1.12.0] - ?
+
+- Added support for adjusting binary detection regex in FullHttpMessageFormatter
+
 ## [1.11.2] - 2021-08-03
 
 - Support GuzzleHttp/Psr7 version 2.0 in the (deprecated) GuzzleStreamFactory.

spec/Formatter/FullHttpMessageFormatterSpec.php

@@ -249,6 +249,27 @@ function it_omits_body_with_null_bytes(RequestInterface $request, StreamInterfac
         $this->formatRequest($request)->shouldReturn($expectedMessage);
     }
 
+    function it_allows_to_change_binary_detection(RequestInterface $request, StreamInterface $stream)
+    {
+        $this->beConstructedWith(1, '/\x01/');
+
+        $stream->isSeekable()->willReturn(true);
+        $stream->rewind()->shouldBeCalled();
+        $stream->__toString()->willReturn("\0");
+        $request->getBody()->willReturn($stream);
+        $request->getMethod()->willReturn('GET');
+        $request->getRequestTarget()->willReturn('/foo');
+        $request->getProtocolVersion()->willReturn('1.1');
+        $request->getHeaders()->willReturn([]);
+
+        $expectedMessage = <<<STR
+GET /foo HTTP/1.1
+
+\x0
+STR;
+        $this->formatRequest($request)->shouldReturn($expectedMessage);
+    }
+
     function it_omits_body_with_line_break(RequestInterface $request, StreamInterface $stream)
     {
         $this->beConstructedWith(7);

src/Formatter/FullHttpMessageFormatter.php

@@ -21,12 +21,19 @@ class FullHttpMessageFormatter implements Formatter
      */
     private $maxBodyLength;
 
+    /**
+     * @var string
+     */
+    private $binaryDetectionRegex;
+
     /**
      * @param int|null $maxBodyLength
+     * @param string   $binaryDetectionRegex By default, this is all non-printable ASCII characters and <DEL> except for \t, \r, \n
      */
-    public function __construct($maxBodyLength = 1000)
+    public function __construct($maxBodyLength = 1000, string $binaryDetectionRegex = '/([\x00-\x09\x0C\x0E-\x1F\x7F])/')
     {
         $this->maxBodyLength = $maxBodyLength;
+        $this->binaryDetectionRegex = $binaryDetectionRegex;
     }
 
     /**
@@ -86,8 +93,7 @@ private function addBody(MessageInterface $request, $message)
         $data = $stream->__toString();
         $stream->rewind();
 
-        // all non-printable ASCII characters and <DEL> except for \t, \r, \n
-        if (preg_match('/([\x00-\x09\x0C\x0E-\x1F\x7F])/', $data)) {
+        if (preg_match($this->binaryDetectionRegex, $data)) {
             return $message.'[binary stream omitted]';
         }