AbstractInputParser::getAllHeaders() recurses into itself instead of calling PHP's getallheaders() #34

AbstractInputParser::getAllHeaders() calls itself unconditionally when PHP's getallheaders() is available, recursing until the stack blows.

src/InputParsers/AbstractInputParser.php (~line 73):

private function getAllHeaders()
{
    if (function_exists('getAllHeaders')) {
        return $this->getAllHeaders();   // <-- $this->, not the global function
    }

    $headers = [];
    ...
}

function_exists() is case-insensitive for function names, so on any SAPI providing getallheaders() — Apache mod_php, and PHP-FPM since 7.3 — the guard passes and $this->getAllHeaders() re-enters the same method. The intended call is the global getallheaders(), i.e. return getallheaders();.

The fallback branch below it (building headers from $_SERVER) is correct and is what runs on SAPIs without the function — which is why this has gone unnoticed.

Severity

Low. The class is deprecated and the method is private, so this is only reachable if something still constructs an input parser that calls it. Recording it rather than leaving a landmine for whoever revisits these classes.

If the deprecated input parsers are due for removal, closing this by deleting them is a perfectly good outcome.

Found during the coverage work in #28, which left the input parsers untested on the grounds that they read php://input and getallheaders() directly and are deprecated.