Only http and https are allowed

Bug #42637

SoapFault : Only http and https are allowed

Submitted:

2007-09-12 06:51 UTC

Modified:

2007-10-17 11:20 UTC

Votes:	12
Avg. Score:	4.8 ± 0.6
Reproduced:	10 of 10 (100.0%)
Same Version:	10 (100.0%)
Same OS:	4 (40.0%)

From:

christof at sanmax dot be

Assigned:

dmitry (profile)

Status:

Closed

Package:

SOAP related

PHP Version:

5.2.4

OS:

Linux

Private report:

CVE-ID:

None

[2007-09-12 06:51 UTC] christof at sanmax dot be

Description:
------------
When sending a request with the SoapClient, a SoapFault is produced :

Fatal error: Uncaught SoapFault exception: [HTTP] Unknown protocol. Only http and https are allowed.

The probleem seems to be located in the php_url_parse_ex function. In version 5.1.6 it works fine, in 5.2.4 is does not. The php scheme is null instead of http according to our tests.

Reproduce code:
---------------
$base = 'http://<some soap service url>/service.asmx?WSDL';
$soap = new SoapClient($base, array('trace' => 1));

$login = new StdClass;
$login->userName  = 'test';
$login->passWord  = 'test';
$login->languageCode = 'NL';

$loginResult = $soap->Login($login);


Expected result:
----------------
no soapfault. In php 5.1.6 it works fine, no exception is thrown.

Actual result:
--------------
Fatal error: Uncaught SoapFault exception: [HTTP] Unknown protocol. Only http and https are allowed in /home/data/websites/www/phptest.php:10
Stack trace:
#0 [internal function]: SoapClient->__doRequest('<?xml version="...', 'http://demobet5...', 'http://XServer....', 1, 0)
#1 [internal function]: SoapClient->__call('Login', Array)
#2 /home/data/websites/www/phptest.php(10): SoapClient->Login(Object(stdClass))
#3 {main}
  thrown in /home/data/websites/www/phptest.php on line 10

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports

[2007-09-27 16:04 UTC] wmoran at collaborativefusion dot com

I can narrow this down a bit further.  We did not see this behavior with 5.2.3, but it occurs with 5.2.4.

[2007-09-27 16:19 UTC] wmoran at collaborativefusion dot com

Correction to my last note:
It worked in 5.2.1.  I have no testing history against 5.2.2 and 5.2.3.

[2007-09-28 15:45 UTC] wmoran at collaborativefusion dot com

I have yet more information.  The problem is related to HTTP redirect codes (3XX).  PHP attempts to follow the redirect, but if the ->scheme is not provided in the redirect URL, PHP leaves it NULL.

See the changes in php_http.c around line 921:
http://cvs.php.net/viewvc.cgi/php-src/ext/soap/php_http.c?view=diff&r1=1.77.2.11.2.5%3Aphp_5_2_1&tr1=1.109&r2=1.77.2.11.2.12%3Aphp_5_2_4&tr2=1.1&diff_format=h

I'm unclear as to the logic in the 5.2.4 code, as the 5.2.1 version seems to be correct, or at least:
new_url->scheme = phpurl->scheme ? estrdup(phpurl->scheme) : NULL;
would make more sense to me.

In particular, it's significant to note that you can not reproduce this unless your soap server issues a 3XX response to your original request, and does not include a scheme in the Location header of that response.

[2007-09-28 17:02 UTC] wmoran at collaborativefusion dot com

In the file ext/soap/php_http.c, changing line 921 from
new_url->scheme = NULL;
to
new_url->scheme = phpurl->scheme ? estrdup(phpurl->scheme) : NULL;

Solves the problem for me.

[2007-10-17 11:20 UTC] dmitry@php.net

This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.