Merge pull request #1381 from nextcloud/bump/guzzle-psr7/stable20

[stable20] sec(deps): Update guzzlehttp/psr7
2023-04-26 15:49:39 +02:00 · 2023-04-26 15:49:39 +02:00 · ee9163915b
--- a/composer.lock
+++ b/composer.lock
@ -1483,16 +1483,16 @@
        },
        {
            "name": "guzzlehttp/psr7",
-            "version": "1.9.0",
+            "version": "1.9.1",
            "source": {
                "type": "git",
                "url": "https://github.com/guzzle/psr7.git",
-                "reference": "e98e3e6d4f86621a9b75f623996e6bbdeb4b9318"
+                "reference": "e4490cabc77465aaee90b20cfc9a770f8c04be6b"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/guzzle/psr7/zipball/e98e3e6d4f86621a9b75f623996e6bbdeb4b9318",
-                "reference": "e98e3e6d4f86621a9b75f623996e6bbdeb4b9318",
+                "url": "https://api.github.com/repos/guzzle/psr7/zipball/e4490cabc77465aaee90b20cfc9a770f8c04be6b",
+                "reference": "e4490cabc77465aaee90b20cfc9a770f8c04be6b",
                "shasum": ""
            },
            "require": {
@ -1511,11 +1511,6 @@
                "laminas/laminas-httphandlerrunner": "Emit PSR-7 responses"
            },
            "type": "library",
-            "extra": {
-                "branch-alias": {
-                    "dev-master": "1.9-dev"
-                }
-            },
            "autoload": {
                "files": [
                    "src/functions_include.php"
@ -1573,7 +1568,7 @@
            ],
            "support": {
                "issues": "https://github.com/guzzle/psr7/issues",
-                "source": "https://github.com/guzzle/psr7/tree/1.9.0"
+                "source": "https://github.com/guzzle/psr7/tree/1.9.1"
            },
            "funding": [
                {
@ -1589,7 +1584,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2022-06-20T21:43:03+00:00"
+            "time": "2023-04-17T16:00:37+00:00"
        },
        {
            "name": "guzzlehttp/ringphp",
--- a/composer/ClassLoader.php
+++ b/composer/ClassLoader.php
@ -429,7 +429,8 @@ class ClassLoader
    public function loadClass($class)
    {
        if ($file = $this->findFile($class)) {
-            (self::$includeFile)($file);
+            $includeFile = self::$includeFile;
+            $includeFile($file);

            return true;
        }
@ -560,7 +561,10 @@ class ClassLoader
        return false;
    }

-    private static function initializeIncludeClosure(): void
+    /**
+     * @return void
+     */
+    private static function initializeIncludeClosure()
    {
        if (self::$includeFile !== null) {
            return;
@ -574,8 +578,8 @@ class ClassLoader
         * @param  string $file
         * @return void
         */
-        self::$includeFile = static function($file) {
+        self::$includeFile = \Closure::bind(static function($file) {
            include $file;
-        };
+        }, null, null);
    }
 }
--- a/composer/InstalledVersions.php
+++ b/composer/InstalledVersions.php
@ -98,7 +98,7 @@ class InstalledVersions
    {
        foreach (self::getInstalled() as $installed) {
            if (isset($installed['versions'][$packageName])) {
-                return $includeDevRequirements || empty($installed['versions'][$packageName]['dev_requirement']);
+                return $includeDevRequirements || !isset($installed['versions'][$packageName]['dev_requirement']) || $installed['versions'][$packageName]['dev_requirement'] === false;
            }
        }

@ -119,7 +119,7 @@ class InstalledVersions
     */
    public static function satisfies(VersionParser $parser, $packageName, $constraint)
    {
-        $constraint = $parser->parseConstraints($constraint);
+        $constraint = $parser->parseConstraints((string) $constraint);
        $provided = $parser->parseConstraints(self::getVersionRanges($packageName));

        return $provided->matches($constraint);
@ -328,7 +328,9 @@ class InstalledVersions
                if (isset(self::$installedByVendor[$vendorDir])) {
                    $installed[] = self::$installedByVendor[$vendorDir];
                } elseif (is_file($vendorDir.'/composer/installed.php')) {
-                    $installed[] = self::$installedByVendor[$vendorDir] = require $vendorDir.'/composer/installed.php';
+                    /** @var array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>} $required */
+                    $required = require $vendorDir.'/composer/installed.php';
+                    $installed[] = self::$installedByVendor[$vendorDir] = $required;
                    if (null === self::$installed && strtr($vendorDir.'/composer', '\\', '/') === strtr(__DIR__, '\\', '/')) {
                        self::$installed = $installed[count($installed) - 1];
                    }
@ -340,12 +342,17 @@ class InstalledVersions
            // only require the installed.php file if this file is loaded from its dumped location,
            // and not from its source location in the composer/composer package, see https://github.com/composer/composer/issues/9937
            if (substr(__DIR__, -8, 1) !== 'C') {
-                self::$installed = require __DIR__ . '/installed.php';
+                /** @var array{root: array{name: string, pretty_version: string, version: string, reference: string|null, type: string, install_path: string, aliases: string[], dev: bool}, versions: array<string, array{pretty_version?: string, version?: string, reference?: string|null, type?: string, install_path?: string, aliases?: string[], dev_requirement: bool, replaced?: string[], provided?: string[]}>} $required */
+                $required = require __DIR__ . '/installed.php';
+                self::$installed = $required;
            } else {
                self::$installed = array();
            }
        }
-        $installed[] = self::$installed;
+
+        if (self::$installed !== array()) {
+            $installed[] = self::$installed;
+        }

        return $installed;
    }
--- a/composer/autoload_real.php
+++ b/composer/autoload_real.php
@ -39,15 +39,15 @@ class ComposerAutoloaderInit2f23f73bc0cc116b4b1eee1521aa8652
        $loader->register(true);

        $filesToLoad = \Composer\Autoload\ComposerStaticInit2f23f73bc0cc116b4b1eee1521aa8652::$files;
-        $requireFile = static function ($fileIdentifier, $file) {
+        $requireFile = \Closure::bind(static function ($fileIdentifier, $file) {
            if (empty($GLOBALS['__composer_autoload_files'][$fileIdentifier])) {
                $GLOBALS['__composer_autoload_files'][$fileIdentifier] = true;

                require $file;
            }
-        };
+        }, null, null);
        foreach ($filesToLoad as $fileIdentifier => $file) {
-            ($requireFile)($fileIdentifier, $file);
+            $requireFile($fileIdentifier, $file);
        }

        return $loader;
--- a/composer/installed.json
+++ b/composer/installed.json
@ -1540,17 +1540,17 @@
        },
        {
            "name": "guzzlehttp/psr7",
-            "version": "1.9.0",
-            "version_normalized": "1.9.0.0",
+            "version": "1.9.1",
+            "version_normalized": "1.9.1.0",
            "source": {
                "type": "git",
                "url": "https://github.com/guzzle/psr7.git",
-                "reference": "e98e3e6d4f86621a9b75f623996e6bbdeb4b9318"
+                "reference": "e4490cabc77465aaee90b20cfc9a770f8c04be6b"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/guzzle/psr7/zipball/e98e3e6d4f86621a9b75f623996e6bbdeb4b9318",
-                "reference": "e98e3e6d4f86621a9b75f623996e6bbdeb4b9318",
+                "url": "https://api.github.com/repos/guzzle/psr7/zipball/e4490cabc77465aaee90b20cfc9a770f8c04be6b",
+                "reference": "e4490cabc77465aaee90b20cfc9a770f8c04be6b",
                "shasum": ""
            },
            "require": {
@ -1568,13 +1568,8 @@
            "suggest": {
                "laminas/laminas-httphandlerrunner": "Emit PSR-7 responses"
            },
-            "time": "2022-06-20T21:43:03+00:00",
+            "time": "2023-04-17T16:00:37+00:00",
            "type": "library",
-            "extra": {
-                "branch-alias": {
-                    "dev-master": "1.9-dev"
-                }
-            },
            "installation-source": "dist",
            "autoload": {
                "files": [
@ -1633,7 +1628,7 @@
            ],
            "support": {
                "issues": "https://github.com/guzzle/psr7/issues",
-                "source": "https://github.com/guzzle/psr7/tree/1.9.0"
+                "source": "https://github.com/guzzle/psr7/tree/1.9.1"
            },
            "funding": [
                {
@ -2532,6 +2527,11 @@
                "pseudorandom",
                "random"
            ],
+            "support": {
+                "email": "info@paragonie.com",
+                "issues": "https://github.com/paragonie/random_compat/issues",
+                "source": "https://github.com/paragonie/random_compat"
+            },
            "install-path": "../paragonie/random_compat"
        },
        {
@ -3502,6 +3502,9 @@
                "request",
                "response"
            ],
+            "support": {
+                "source": "https://github.com/php-fig/http-message/tree/master"
+            },
            "install-path": "../psr/http-message"
        },
        {
@ -3663,6 +3666,10 @@
                }
            ],
            "description": "A polyfill for getallheaders.",
+            "support": {
+                "issues": "https://github.com/ralouphie/getallheaders/issues",
+                "source": "https://github.com/ralouphie/getallheaders/tree/develop"
+            },
            "install-path": "../ralouphie/getallheaders"
        },
        {
@ -6240,6 +6247,6 @@
            "install-path": "../web-auth/webauthn-lib"
        }
    ],
-    "dev": true,
+    "dev": false,
    "dev-package-names": []
 }
--- a/composer/installed.php
+++ b/composer/installed.php
@ -3,11 +3,11 @@
        'name' => 'nextcloud/3rdparty',
        'pretty_version' => 'dev-master',
        'version' => 'dev-master',
-        'reference' => '36bdf1027463c261bde1c7c7170b61d91c662198',
+        'reference' => 'b662cd14738aae34ac2006de1c81cb6220b78b72',
        'type' => 'library',
        'install_path' => __DIR__ . '/../',
        'aliases' => array(),
-        'dev' => true,
+        'dev' => false,
    ),
    'versions' => array(
        'aws/aws-sdk-php' => array(
@ -200,9 +200,9 @@
            'dev_requirement' => false,
        ),
        'guzzlehttp/psr7' => array(
-            'pretty_version' => '1.9.0',
-            'version' => '1.9.0.0',
-            'reference' => 'e98e3e6d4f86621a9b75f623996e6bbdeb4b9318',
+            'pretty_version' => '1.9.1',
+            'version' => '1.9.1.0',
+            'reference' => 'e4490cabc77465aaee90b20cfc9a770f8c04be6b',
            'type' => 'library',
            'install_path' => __DIR__ . '/../guzzlehttp/psr7',
            'aliases' => array(),
@ -319,7 +319,7 @@
        'nextcloud/3rdparty' => array(
            'pretty_version' => 'dev-master',
            'version' => 'dev-master',
-            'reference' => '36bdf1027463c261bde1c7c7170b61d91c662198',
+            'reference' => 'b662cd14738aae34ac2006de1c81cb6220b78b72',
            'type' => 'library',
            'install_path' => __DIR__ . '/../',
            'aliases' => array(),
--- a/guzzlehttp/psr7/CHANGELOG.md
+++ b/guzzlehttp/psr7/CHANGELOG.md
@ -9,6 +9,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

 ## Unreleased

+## 1.9.1 - 2023-04-17
+
+### Fixed
+
+- Fixed header validation issue
+
 ## 1.9.0 - 2022-06-20

 ### Added
--- a/guzzlehttp/psr7/composer.json
+++ b/guzzlehttp/psr7/composer.json
@ -61,11 +61,6 @@
            "GuzzleHttp\\Tests\\Psr7\\": "tests/"
        }
    },
-    "extra": {
-        "branch-alias": {
-            "dev-master": "1.9-dev"
-        }
-    },
    "config": {
        "preferred-install": "dist",
        "sort-packages": true,
--- a/guzzlehttp/psr7/src/MessageTrait.php
+++ b/guzzlehttp/psr7/src/MessageTrait.php
@ -226,12 +226,9 @@ trait MessageTrait
            throw new \InvalidArgumentException('Header name can not be empty.');
        }

-        if (! preg_match('/^[a-zA-Z0-9\'`#$%&*+.^_|~!-]+$/', $header)) {
+        if (! preg_match('/^[a-zA-Z0-9\'`#$%&*+.^_|~!-]+$/D', $header)) {
            throw new \InvalidArgumentException(
-                sprintf(
-                    '"%s" is not valid header name',
-                    $header
-                )
+                sprintf('"%s" is not valid header name.', $header)
            );
        }
    }
@ -263,8 +260,10 @@ trait MessageTrait
        // Clients must not send a request with line folding and a server sending folded headers is
        // likely very rare. Line folding is a fairly obscure feature of HTTP/1.1 and thus not accepting
        // folding is not likely to break any legitimate use case.
-        if (! preg_match('/^[\x20\x09\x21-\x7E\x80-\xFF]*$/', $value)) {
-            throw new \InvalidArgumentException(sprintf('"%s" is not valid header value', $value));
+        if (! preg_match('/^[\x20\x09\x21-\x7E\x80-\xFF]*$/D', $value)) {
+            throw new \InvalidArgumentException(
+                sprintf('"%s" is not valid header value.', $value)
+            );
        }
    }
 }