JayBizzle / Crawler-Detect
96%

DEFAULT BRANCH: master
Repo Added
Files 5
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

LAST BUILD ON BRANCH master
branch: SELECT
CHANGE BRANCH
x

coverage: 96.226% (+0.8%) from 95.455%
30586796524

push

github

web-flow 
Normalise header names so non-SAPI sources work (#617)

* Normalise header names so non-SAPI sources work

setHttpHeaders() filtered on the HTTP_ prefix, so it only ever understood
the _SERVER-style names PHP's SAPI produces. Headers from anywhere else —
a PSR-7 request, Symfony's HeaderBag, Swoole, a Lambda event — carry their
real names ('User-Agent'), were dropped by that filter, and left the user
agent null. The idiomatic call for those sources therefore reported every
request as human, with no error to hint otherwise:

    $cd = new CrawlerDetect($request->getHeaders());
    $cd->isCrawler();  // always false

Callers who worked around it with isCrawler($request->getHeaderLine(...))
got the User-Agent checked but silently lost the rest of the chain in
Fixtures\Headers — including From and Sec-CH-UA, the two headers that catch
crawlers sending a genuine browser User-Agent.

Header names are now reduced to a canonical form (uppercased, underscore
separated, HTTP_ prefix stripped) and stored back under HTTP_, so both
naming styles land on the same key and setUserAgent() is unchanged. Values
may now be arrays too, since PSR-7 and HttpFoundation both expose them that
way.

Nothing public changes: getUaHttpHeaders() still returns prefixed names,
$this->httpHeaders keeps its HTTP_ key shape, and the _SERVER prefix filter
still excludes non-header vars such as REQUEST_URI.

* Only strip the HTTP_ prefix from genuine SAPI keys

normaliseHeaderName() folded hyphens to underscores before testing for the
prefix, so a real header named 'Http-User-Agent' became HTTP_USER_AGENT,
had the prefix stripped, and was read as the actual user agent. Same for
'Http-From' and any other Http-* custom header, giving an attacker-supplied
false positive.

Testing the prefix before folding hyphens means only an underscore
separated SAPI key can lose it. Nothing is given up: the SAPI never emits
hyphenated keys, so no real source needs the conversion to happen first.

11 of 11 new or added lines in 1 file covered. (100.0%)

51 of 53 relevant lines covered (96.23%)

22.34 hits per line

Relevant lines Covered
53 RELEVANT LINES 51 COVERED LINES
22.34 HITS PER LINE
Source Files on master

Recent builds

Builds Branch Commit Type Ran Committer Via Coverage
30586796524 master Normalise header names so non-SAPI sources work (#617) * Normalise header names so non-SAPI sources work setHttpHeaders() filtered on the HTTP_ prefix, so it only ever understood the _SERVER-style names PHP's SAPI produces. Headers from anywhere... push web-flow github
96.23
30497802435 normalise-header-names Merge 4970879c0 into 770e00e5b Pull #617 web-flow github
96.23
30497123016 normalise-header-names Merge 79c3579f0 into 770e00e5b Pull #617 web-flow github
96.08
29099061547 master Add signatures for Palo Alto Cortex Xpanse, Infrawatch, ModatScanner,… (#616) push web-flow github
95.45
29077650452 add-scanner-bot-signatures Merge 65957a0bf into ed842b98a Pull #616 web-flow github
95.45
27369210037 master Bump actions to Node 24-ready versions (#614) GitHub forces actions onto Node 24 from 2026-06-16; the Test run flagged actions/checkout@v4 and actions/cache@v4 as affected. - actions/checkout v4 -> v5 (Node 24, no other changes; deliberately n... push web-flow github
100.0
27369046044 chore/node24-actions Merge 30e3e285d into 20d7bd4a6 Pull #614 web-flow github
100.0
27368777057 master Drop PHP 7.1 support; tighten phpunit constraint (#608) Closes the open Dependabot alert on phpunit/phpunit (GHSA-vvj3-c3rp-c85p — unsafe deserialization in PHPT code coverage handling, fixed in 8.5.52). The previous require-dev constraint `^4.8|... push web-flow github
100.0
27306816198 security/phpunit-bump Merge 6e9263c16 into a2a5f5450 Pull #608 web-flow github
100.0
27306650538 master Modernize test suite and CI: PHP 8.5, migrated phpunit config, test renames (#611) * Modernize test suite and CI: PHP 8.5, migrated config, test renames - Add PHP 8.5 to the CI matrix and move the coverage job from 8.3 to 8.4. - Migrate phpuni... push web-flow github
100.0
See All Builds (1690)