JayBizzle / Crawler-Detect / 30586796524

96%

push

github

Normalise header names so non-SAPI sources work (#617)

* Normalise header names so non-SAPI sources work

setHttpHeaders() filtered on the HTTP_ prefix, so it only ever understood
the _SERVER-style names PHP's SAPI produces. Headers from anywhere else —
a PSR-7 request, Symfony's HeaderBag, Swoole, a Lambda event — carry their
real names ('User-Agent'), were dropped by that filter, and left the user
agent null. The idiomatic call for those sources therefore reported every
request as human, with no error to hint otherwise:

    $cd = new CrawlerDetect($request->getHeaders());
    $cd->isCrawler();  // always false

Callers who worked around it with isCrawler($request->getHeaderLine(...))
got the User-Agent checked but silently lost the rest of the chain in
Fixtures\Headers — including From and Sec-CH-UA, the two headers that catch
crawlers sending a genuine browser User-Agent.

Header names are now reduced to a canonical form (uppercased, underscore
separated, HTTP_ prefix stripped) and stored back under HTTP_, so both
naming styles land on the same key and setUserAgent() is unchanged. Values
may now be arrays too, since PSR-7 and HttpFoundation both expose them that
way.

Nothing public changes: getUaHttpHeaders() still returns prefixed names,
$this->httpHeaders keeps its HTTP_ key shape, and the _SERVER prefix filter
still excludes non-header vars such as REQUEST_URI.

* Only strip the HTTP_ prefix from genuine SAPI keys

normaliseHeaderName() folded hyphens to underscores before testing for the
prefix, so a real header named 'Http-User-Agent' became HTTP_USER_AGENT,
had the prefix stripped, and was read as the actual user agent. Same for
'Http-From' and any other Http-* custom header, giving an attacker-supplied
false positive.

Testing the prefix before folding hyphens means only an underscore
separated SAPI key can lose it. Nothing is given up: the SAPI never emits
hyphenated keys, so no real source needs the conversion to happen first.

11 of 11 new or added lines in 1 file covered. (100.0%)

51 of 53 relevant lines covered (96.23%)

22.34 hits per line