bug symfony#58860 [HttpClient] Fix catching some invalid Location headers (nicolas-grekas)

This PR was merged into the 5.4 branch.

Discussion
----------

[HttpClient] Fix catching some invalid Location headers

| Q             | A
| ------------- | ---
| Branch?       | 5.4
| Bug fix?      | yes
| New feature?  | no
| Deprecations? | no
| Issues        | Fix symfony#58857
| License       | MIT

Commits
-------

7f94d4a [HttpClient] Fix catching some invalid Location headers

Author: nicolas-grekas

src/Symfony/Component/HttpClient/CurlHttpClient.php

@@ -425,6 +425,8 @@ private static function createRedirectResolver(array $options, string $host): \C
             try {
                 $locationHasHost = false;
                 $location = self::parseUrl($location);
+                $url = self::parseUrl(curl_getinfo($ch, \CURLINFO_EFFECTIVE_URL));
+                $url = self::resolveUrl($location, $url);
             } catch (InvalidArgumentException $e) {
                 return null;
             }
@@ -446,9 +448,6 @@ private static function createRedirectResolver(array $options, string $host): \C
                 curl_setopt($ch, \CURLOPT_HTTPHEADER, $redirectHeaders['with_auth']);
             }
 
-            $url = self::parseUrl(curl_getinfo($ch, \CURLINFO_EFFECTIVE_URL));
-            $url = self::resolveUrl($location, $url);
-
             curl_setopt($ch, \CURLOPT_PROXY, self::getProxyUrl($options['proxy'], $url));
 
             return implode('', $url);

src/Symfony/Component/HttpClient/NativeHttpClient.php

@@ -383,14 +383,14 @@ private static function createRedirectResolver(array $options, string $host, ?ar
 
             try {
                 $url = self::parseUrl($location);
+                $locationHasHost = isset($url['authority']);
+                $url = self::resolveUrl($url, $info['url']);
             } catch (InvalidArgumentException $e) {
                 $info['redirect_url'] = null;
 
                 return null;
             }
 
-            $locationHasHost = isset($url['authority']);
-            $url = self::resolveUrl($url, $info['url']);
             $info['redirect_url'] = implode('', $url);
 
             if ($info['redirect_count'] >= $maxRedirects) {

src/Symfony/Component/HttpClient/Tests/HttpClientTestCase.php

@@ -494,7 +494,11 @@ public function testNoRedirectWithInvalidLocation()
     {
         $client = $this->getHttpClient(__FUNCTION__);
 
-        $response = $client->request('GET', 'http://localhost:8057/302-no-scheme');
+        $response = $client->request('GET', 'http://localhost:8057/302?location=localhost:8067');
+
+        $this->assertSame(302, $response->getStatusCode());
+
+        $response = $client->request('GET', 'http://localhost:8057/302?location=http:localhost');
 
         $this->assertSame(302, $response->getStatusCode());
     }

src/Symfony/Contracts/HttpClient/Test/Fixtures/web/index.php

@@ -31,7 +31,7 @@
 
 $json = json_encode($vars, \JSON_PRETTY_PRINT | \JSON_UNESCAPED_SLASHES | \JSON_UNESCAPED_UNICODE);
 
-switch ($vars['REQUEST_URI']) {
+switch (parse_url($vars['REQUEST_URI'], \PHP_URL_PATH)) {
     default:
         exit;
 
@@ -94,13 +94,8 @@
 
     case '/302':
         if (!isset($vars['HTTP_AUTHORIZATION'])) {
-            header('Location: http://localhost:8057/', true, 302);
-        }
-        break;
-
-    case '/302-no-scheme':
-        if (!isset($vars['HTTP_AUTHORIZATION'])) {
-            header('Location: localhost:8067', true, 302);
+            $location = $_GET['location'] ?? 'http://localhost:8057/';
+            header('Location: '.$location, true, 302);
         }
         break;