roadrunner: [๐Ÿ› BUG]: Request field ordering is random

No duplicates ๐Ÿฅฒ.

  • I have searched for a similar issue in our bug tracker and didnโ€™t find any solutions.

What happened?

Sending the same HTTP request (multipart/form-data) to Roadrunner is sending randomly ordered parameters to PHP.

Itโ€™s causing issues with GraphQL specs validation, like in this bundle - https://github.com/overblog/GraphQLBundle/blob/master/src/Request/UploadParserTrait.php#L68

Version (rr --version)

2023.1.4 / 2023.1.5 / 2023.2.0-beta.3

How to reproduce the issue?

  1. Send Request to PHP application:
curl 'http://localhost/' -H 'Accept: application/json' -H 'Content-Type: multipart/form-data; boundary=----BND' \
  --data-raw $'------BND\r\nContent-Disposition: form-data; name="var1"\r\n\r\nfirst\r\n------BND\r\nContent-Disposition: form-data; name="var2"\r\n\r\nsecond\r\n------BND--\r\n'
  1. Observe parameters are randomly displaying var1 or var2 as the first parameter in $buffer variable here: https://github.com/roadrunner-php/goridge/blob/4.x/src/StreamRelay.php#L88

.rr.yaml file content:

version: "3"

rpc:
    listen: tcp://127.0.0.1:6001
server:
    command: "php public/index.php"
    env:
        - APP_RUNTIME: App\Runtime\Runtime
http:
    enable:     true
    address:    0.0.0.0:8080
    max_request_size: 20
    middleware: [ "headers" ]
    uploads:
        forbid: [".php", ".exe", ".bat"]
    headers:
        cors:
            allowed_origin: "*"
            allowed_headers: "*"
            allowed_methods: "GET,POST,PUT,DELETE"
            allow_credentials: true
            exposed_headers: "Cache-Control,Content-Language,Content-Type,Expires,Last-Modified,Pragma"
            max_age: 600
    pool:
        num_workers: 24
        max_jobs: 0
        allocate_timeout: 60s
        destroy_timeout: 60s
        supervisor:
            watch_tick: 1s
            ttl: 1800s
            idle_ttl: 10s
            max_worker_memory: 128
            exec_ttl: 300s
logs:
    mode: production
    level: error
    encoding: json
    file_logger_options:
        log_output: "var/log/rr.log"
        max_size: 50
        max_age: 24
        max_backups: 10
        compress: true

Relevant log output

No response

About this issue

  • Original URL
  • State: open
  • Created a year ago
  • Reactions: 1
  • Comments: 18 (12 by maintainers)

Most upvoted comments

To be clear, I know why theyโ€™re random. To preprocess all the form-data fields, I use a hashmap. In the hashmap the order is not guaranteed.

I double checked the RFC, and yes, the bug is valid and youโ€™re right, we should not reorder the results if we treat the http plugin as an intermediary between the user and the actual script. Will be fixed in the first 2023.2.x bugfix release. Thanks for the report ๐Ÿ‘๐Ÿป