Skip to content

Merge upstream#58

Merged
Alkarex merged 25 commits intofreshrssfrom
merge-upstream
Sep 30, 2025
Merged

Merge upstream#58
Alkarex merged 25 commits intofreshrssfrom
merge-upstream

Conversation

Alkarex and others added 25 commits September 20, 2025 18:21
fix simplepie#942

Some feeds are not parsed correctly due to wrong handling of [HTTP trailer headers](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Trailer) such as [Server-Timing](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Server-Timing).

Example of feed:
https://www.caranddriver.com/rss/all.xml
(Note that the bug may or may not exhibit itself depending on the cURL and PHP versions)

Downstream discussion:
* FreshRSS/FreshRSS#7981
* FreshRSS/FreshRSS#7983

SimplePie tries to XML parse something like `</rss>server-timing: rtt; dur=6.131, retrans; dur=0, trailer-timestamp; dur=1758222994925` which obviously fails.

In the case of normal HTTP transfer (not chunked), we need to use content-length to know where the body stops, but content-length is wrong if any compression was used.
So I believe we should let cURL perform the separation of HTTP headers and body instead of using the SimplePie parser.
This type hint is a syntax only supported by PHPStan, so it generates errors in other systems such as Intellephense
After updating selfoss to SimplePie 1.9.0, PHPStan started to complain:

    Parameter #1 $level of method SimplePie\SimplePie::set_autodiscovery_level() expects 0|1|2|4|8|16|31, 7 given.

Yet, the PHPDoc claimed:

    level can be a combination of the above constants, see bitwise OR operator

Let’s swtich to `int-mask-of`.
`CURLINFO_REDIRECT_COUNT` is only non-zero when `CURLOPT_FOLLOWLOCATION` is enabled
but we track redirects ourselves since 692e8bc.

https://curl.se/libcurl/c/CURLOPT_FOLLOWLOCATION.html
https://curl.se/libcurl/c/CURLINFO_REDIRECT_COUNT.html
Since starting to handle redirects ourselves in 692e8bc, `url` info item (aka `CURLINFO_EFFECTIVE_URL`) will be the same as the initial URI.
In fact, when the server sends interim responses, this was counterproductive – it would overwrite the final response code returned by `CURLINFO_HTTP_CODE` with the interim one (e.g. 100).
Though, the parser will still include the headers of all but the first response in the body.
Explicit comparison is clearer than relying on `CURLE_OK` being falsey (`0`).
This is only needed for PHPStan.

Making the type assertion explicit and moving it earlier will allow us to make the `prepareHeaders` call conditional without having to add more casts.
The method call was introduced in 4b1fc33 to support tunneling through HTTP proxy using CONNECT method, whose response curl includes in the `curl_exec` result.

Ideally, we would prevent that with `CURLOPT_SUPPRESS_CONNECT_HEADERS` but that is only available in PHP 7.3:
https://www.php.net/manual/en/curl.constants.php#constant.curlopt-suppress-connect-headers
The implementation of magic_quotes_gpc was removed in PHP 5.4 and the function for checking was dropped in PHP 8.0:
https://www.php.net/manual/en/function.get-magic-quotes-gpc.php
This will slightly simplify the code.
It is an ancient technology for using custom fonts based on Flash.
It will not work in any modern browser.
The test runner was removed in 0fcde72.
Multifeed has been deprecated since ff1b513.
@Alkarex Alkarex merged commit d5c62f3 into freshrss Sep 30, 2025
20 checks passed
@Alkarex Alkarex deleted the merge-upstream branch September 30, 2025 09:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants