php / php/php-src

For php://input fread() writes temp files

Open
#8,239 6 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Category: Engine Feature Status: Verified
Dominant language
C
Stars
40.4k
Forks
8.1k
Avg merge
2d 13h
Merged PRs (30d)
96

Description

Description

The following code:

<?php
// index.php

$postBodyResource = fopen("php://input", 'rb');
while (!feof($postBodyResource)) {
    $data = fread($postBodyResource, 5 * 1024);
}
fclose($postBodyResource);

and Apache 2.4 config

Alias "/api" "${SRVROOT}/htdocs/Api"
<Directory "${SRVROOT}/htdocs/Api">
    RewriteEngine On 
    RewriteCond %{REQUEST_FILEaNAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteRule ^ index.php [QSA,L]

    Script POST "index.php"
    Script PUT "index.php"

    php_value enable_post_data_reading Off
</Directory>

Resulted in this output:
If I do a HTTP POST (Content-Type: application/octet-stream) at http://localhost/api with a body larger than 16 kB, PHP creates a temp file at sys_temp_dir or upload_dir that stores the whole content of the stream php://input while doing fread().

But I expected this output instead:
At least there should be a configuration option to disable writing the temp files.

See temp file writing so caused by php_fopen_wrapper.c#L231.

Please, see Stackoverflow for some discussion.

PHP Version

PHP 7.4+

Operating System

Windows 10 21H2

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with ext/standard/php_fopen_wrapper.c at the linked line and reproduce the PHP 7.4+ behavior using the provided script, Apache configuration, and a POST body over 16 kB on Windows. Trace why php://input writes the complete stream to a temporary file; done means the reported behavior or its configuration control is addressed and covered by a regression test.

Written by the indexing model from the issue text.

Assessment

Tech stack
apache, c, php
Domain
backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.