fix: error 500 on request with 'empty' accept headers, e.g. 'accept: 0' or 'accept: ' (#5767)

* BUG: Error 500 on request with 'empty' Accept headers, e.g. 'Accept: 0' or 'Accept:   '

Author: alebedev80

src/Symfony/EventListener/AddFormatListener.php

@@ -16,6 +16,7 @@
 use ApiPlatform\Api\FormatMatcher;
 use ApiPlatform\Metadata\Resource\Factory\ResourceMetadataCollectionFactoryInterface;
 use ApiPlatform\Util\OperationRequestInitiatorTrait;
+use Negotiation\Exception\InvalidArgument;
 use Negotiation\Negotiator;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpKernel\Event\RequestEvent;
@@ -73,8 +74,15 @@ public function onKernelRequest(RequestEvent $event): void
         // First, try to guess the format from the Accept header
         /** @var string|null $accept */
         $accept = $request->headers->get('Accept');
+
         if (null !== $accept) {
-            if (null === $mediaType = $this->negotiator->getBest($accept, $mimeTypes)) {
+            try {
+                $mediaType = $this->negotiator->getBest($accept, $mimeTypes);
+            } catch (InvalidArgument) {
+                throw $this->getNotAcceptableHttpException($accept, $flattenedMimeTypes);
+            }
+
+            if (null === $mediaType) {
                 throw $this->getNotAcceptableHttpException($accept, $flattenedMimeTypes);
             }
 

tests/Symfony/EventListener/AddFormatListenerTest.php

@@ -264,6 +264,32 @@ public function testInvalidAcceptHeader(): void
         $listener->onKernelRequest($event);
     }
 
+    public function testZeroAcceptHeader(): void
+    {
+        $this->expectException(NotAcceptableHttpException::class);
+        $this->expectExceptionMessage('Requested format "0" is not supported. Supported MIME types are "application/octet-stream", "application/json"');
+
+        $request = new Request([], [], ['_api_resource_class' => 'Foo', '_api_operation_name' => 'get']);
+        $request->headers->set('Accept', '0');
+
+        $eventProphecy = $this->prophesize(RequestEvent::class);
+        $eventProphecy->getRequest()->willReturn($request);
+        $event = $eventProphecy->reveal();
+
+        $resourceMetadataFactoryProphecy = $this->prophesize(ResourceMetadataCollectionFactoryInterface::class);
+        $resourceMetadataFactoryProphecy->create('Foo')->shouldBeCalled()->willReturn(new ResourceMetadataCollection('Foo', [
+            new ApiResource(operations: [
+                'get' => new Get(outputFormats: [
+                    'binary' => ['application/octet-stream'],
+                    'json' => ['application/json'],
+                ]),
+            ]),
+        ]));
+
+        $listener = new AddFormatListener(new Negotiator(), $resourceMetadataFactoryProphecy->reveal());
+        $listener->onKernelRequest($event);
+    }
+
     public function testAcceptHeaderTakePrecedenceOverRequestFormat(): void
     {
         $request = new Request([], [], ['_api_resource_class' => 'Foo', '_api_operation_name' => 'get']);