Skip to content

[3.0] [Form] Forbid PUT + File upload #10541

Closed
@lyrixx

Description

@lyrixx

Quoting someone else:

HTTP semantics has it that PUT on a resource should replace
the resource with the representation sent in the request. The
resource is expected to have a equivalent, if not bitwise equal,
representation as the request.
See also the lastest HTTP clarifications.

That means that multipart/form-data is usually wrong with PUT.

I understand that the Form component does encourage this, as simply adding a file element is expected to work. But it would be preferable to fix the Form component and forbid mixing PUT with file elements than working around it and against HTTP semantics. ping @webmozart

What you should do instead is PUT the content of your upload to the very same URL that you use to GET it.
Or use POST instead of PUT, because POST has the required semantics.

An other major problem with the proposed patch is that IF the MIME multipart parsing algorithm should be implemented, it should be against the many relevant RFCs, be tested against variations found into the wild, be stream efficient (should not expect that everything fits in memory), etc. Many subjects that the C source code of PHP has implemented, tested and validated in real life situations. But having our own in Symfony is a hard work.

See #10381 (comment)

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions