Upgrade 1-11.38

vendor/symfony/http-kernel/Tests/HttpCache/EsiTest.php

@@ -12,9 +12,9 @@
 namespace Symfony\Component\HttpKernel\Tests\HttpCache;
 
 use PHPUnit\Framework\TestCase;
-use Symfony\Component\HttpKernel\HttpCache\Esi;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\HttpKernel\HttpCache\Esi;
 
 class EsiTest extends TestCase
 {
@@ -88,7 +88,7 @@ class EsiTest extends TestCase
         $request = Request::create('/');
         $response = new Response();
         $response->headers->set('Content-Type', 'text/plain');
-        $esi->process($request, $response);
+        $this->assertSame($response, $esi->process($request, $response));
 
         $this->assertFalse($response->headers->has('x-body-eval'));
     }
@@ -99,7 +99,7 @@ class EsiTest extends TestCase
 
         $request = Request::create('/');
         $response = new Response('<esi:remove> <a href="http://www.example.com">www.example.com</a> </esi:remove> Keep this'."<esi:remove>\n <a>www.example.com</a> </esi:remove> And this");
-        $esi->process($request, $response);
+        $this->assertSame($response, $esi->process($request, $response));
 
         $this->assertEquals(' Keep this And this', $response->getContent());
     }
@@ -110,7 +110,7 @@ class EsiTest extends TestCase
 
         $request = Request::create('/');
         $response = new Response('<esi:comment text="some comment &gt;" /> Keep this');
-        $esi->process($request, $response);
+        $this->assertSame($response, $esi->process($request, $response));
 
         $this->assertEquals(' Keep this', $response->getContent());
     }
@@ -121,23 +121,23 @@ class EsiTest extends TestCase
 
         $request = Request::create('/');
         $response = new Response('foo <esi:comment text="some comment" /><esi:include src="..." alt="alt" onerror="continue" />');
-        $esi->process($request, $response);
+        $this->assertSame($response, $esi->process($request, $response));
 
         $this->assertEquals('foo <?php echo $this->surrogate->handle($this, \'...\', \'alt\', true) ?>'."\n", $response->getContent());
         $this->assertEquals('ESI', $response->headers->get('x-body-eval'));
 
         $response = new Response('foo <esi:comment text="some comment" /><esi:include src="foo\'" alt="bar\'" onerror="continue" />');
-        $esi->process($request, $response);
+        $this->assertSame($response, $esi->process($request, $response));
 
         $this->assertEquals('foo <?php echo $this->surrogate->handle($this, \'foo\\\'\', \'bar\\\'\', true) ?>'."\n", $response->getContent());
 
         $response = new Response('foo <esi:include src="..." />');
-        $esi->process($request, $response);
+        $this->assertSame($response, $esi->process($request, $response));
 
         $this->assertEquals('foo <?php echo $this->surrogate->handle($this, \'...\', \'\', false) ?>'."\n", $response->getContent());
 
         $response = new Response('foo <esi:include src="..."></esi:include>');
-        $esi->process($request, $response);
+        $this->assertSame($response, $esi->process($request, $response));
 
         $this->assertEquals('foo <?php echo $this->surrogate->handle($this, \'...\', \'\', false) ?>'."\n", $response->getContent());
     }
@@ -148,21 +148,19 @@ class EsiTest extends TestCase
 
         $request = Request::create('/');
         $response = new Response('<?php <? <% <script language=php>');
-        $esi->process($request, $response);
+        $this->assertSame($response, $esi->process($request, $response));
 
         $this->assertEquals('<?php echo "<?"; ?>php <?php echo "<?"; ?> <?php echo "<%"; ?> <?php echo "<s"; ?>cript language=php>', $response->getContent());
     }
 
-    /**
-     * @expectedException \RuntimeException
-     */
     public function testProcessWhenNoSrcInAnEsi()
     {
+        $this->expectException('RuntimeException');
         $esi = new Esi();
 
         $request = Request::create('/');
         $response = new Response('foo <esi:include />');
-        $esi->process($request, $response);
+        $this->assertSame($response, $esi->process($request, $response));
     }
 
     public function testProcessRemoveSurrogateControlHeader()
@@ -172,16 +170,16 @@ class EsiTest extends TestCase
         $request = Request::create('/');
         $response = new Response('foo <esi:include src="..." />');
         $response->headers->set('Surrogate-Control', 'content="ESI/1.0"');
-        $esi->process($request, $response);
+        $this->assertSame($response, $esi->process($request, $response));
         $this->assertEquals('ESI', $response->headers->get('x-body-eval'));
 
         $response->headers->set('Surrogate-Control', 'no-store, content="ESI/1.0"');
-        $esi->process($request, $response);
+        $this->assertSame($response, $esi->process($request, $response));
         $this->assertEquals('ESI', $response->headers->get('x-body-eval'));
         $this->assertEquals('no-store', $response->headers->get('surrogate-control'));
 
         $response->headers->set('Surrogate-Control', 'content="ESI/1.0", no-store');
-        $esi->process($request, $response);
+        $this->assertSame($response, $esi->process($request, $response));
         $this->assertEquals('ESI', $response->headers->get('x-body-eval'));
         $this->assertEquals('no-store', $response->headers->get('surrogate-control'));
     }
@@ -193,11 +191,9 @@ class EsiTest extends TestCase
         $this->assertEquals('foo', $esi->handle($cache, '/', '/alt', true));
     }
 
-    /**
-     * @expectedException \RuntimeException
-     */
     public function testHandleWhenResponseIsNot200()
     {
+        $this->expectException('RuntimeException');
         $esi = new Esi();
         $response = new Response('foo');
         $response->setStatusCode(404);
@@ -220,26 +216,26 @@ class EsiTest extends TestCase
         $response1 = new Response('foo');
         $response1->setStatusCode(404);
         $response2 = new Response('bar');
-        $cache = $this->getCache(Request::create('/'), array($response1, $response2));
+        $cache = $this->getCache(Request::create('/'), [$response1, $response2]);
         $this->assertEquals('bar', $esi->handle($cache, '/', '/alt', false));
     }
 
     protected function getCache($request, $response)
     {
-        $cache = $this->getMockBuilder('Symfony\Component\HttpKernel\HttpCache\HttpCache')->setMethods(array('getRequest', 'handle'))->disableOriginalConstructor()->getMock();
+        $cache = $this->getMockBuilder('Symfony\Component\HttpKernel\HttpCache\HttpCache')->setMethods(['getRequest', 'handle'])->disableOriginalConstructor()->getMock();
         $cache->expects($this->any())
               ->method('getRequest')
-              ->will($this->returnValue($request))
+              ->willReturn($request)
         ;
-        if (is_array($response)) {
+        if (\is_array($response)) {
             $cache->expects($this->any())
                   ->method('handle')
-                  ->will(call_user_func_array(array($this, 'onConsecutiveCalls'), $response))
+                  ->will(\call_user_func_array([$this, 'onConsecutiveCalls'], $response))
             ;
         } else {
             $cache->expects($this->any())
                   ->method('handle')
-                  ->will($this->returnValue($response))
+                  ->willReturn($response)
             ;
         }
 

vendor/symfony/http-kernel/Tests/HttpCache/HttpCacheTestCase.php

@@ -29,6 +29,10 @@ class HttpCacheTestCase extends TestCase
     protected $responses;
     protected $catch;
     protected $esi;
+
+    /**
+     * @var Store
+     */
     protected $store;
 
     protected function setUp()
@@ -37,12 +41,12 @@ class HttpCacheTestCase extends TestCase
 
         $this->cache = null;
         $this->esi = null;
-        $this->caches = array();
-        $this->cacheConfig = array();
+        $this->caches = [];
+        $this->cacheConfig = [];
 
         $this->request = null;
         $this->response = null;
-        $this->responses = array();
+        $this->responses = [];
 
         $this->catch = false;
 
@@ -87,7 +91,7 @@ class HttpCacheTestCase extends TestCase
         $traces = $this->cache->getTraces();
         $traces = current($traces);
 
-        $this->assertRegExp('/'.$trace.'/', implode(', ', $traces));
+        $this->assertMatchesRegularExpression('/'.$trace.'/', implode(', ', $traces));
     }
 
     public function assertTraceNotContains($trace)
@@ -95,7 +99,7 @@ class HttpCacheTestCase extends TestCase
         $traces = $this->cache->getTraces();
         $traces = current($traces);
 
-        $this->assertNotRegExp('/'.$trace.'/', implode(', ', $traces));
+        $this->assertDoesNotMatchRegularExpression('/'.$trace.'/', implode(', ', $traces));
     }
 
     public function assertExceptionsAreCaught()
@@ -108,7 +112,7 @@ class HttpCacheTestCase extends TestCase
         $this->assertFalse($this->kernel->isCatchingExceptions());
     }
 
-    public function request($method, $uri = '/', $server = array(), $cookies = array(), $esi = false, $headers = array())
+    public function request($method, $uri = '/', $server = [], $cookies = [], $esi = false, $headers = [])
     {
         if (null === $this->kernel) {
             throw new \LogicException('You must call setNextResponse() before calling request().');
@@ -122,7 +126,7 @@ class HttpCacheTestCase extends TestCase
 
         $this->esi = $esi ? new Esi() : null;
         $this->cache = new HttpCache($this->kernel, $this->store, $this->esi, $this->cacheConfig);
-        $this->request = Request::create($uri, $method, array(), $cookies, array(), $server);
+        $this->request = Request::create($uri, $method, [], $cookies, [], $server);
         $this->request->headers->add($headers);
 
         $this->response = $this->cache->handle($this->request, HttpKernelInterface::MASTER_REQUEST, $this->catch);
@@ -132,7 +136,7 @@ class HttpCacheTestCase extends TestCase
 
     public function getMetaStorageValues()
     {
-        $values = array();
+        $values = [];
         foreach (new \RecursiveIteratorIterator(new \RecursiveDirectoryIterator(sys_get_temp_dir().'/http_cache/md', \RecursiveDirectoryIterator::SKIP_DOTS), \RecursiveIteratorIterator::LEAVES_ONLY) as $file) {
             $values[] = file_get_contents($file);
         }
@@ -141,7 +145,7 @@ class HttpCacheTestCase extends TestCase
     }
 
     // A basic response with 200 status code and a tiny body.
-    public function setNextResponse($statusCode = 200, array $headers = array(), $body = 'Hello World', \Closure $customizer = null)
+    public function setNextResponse($statusCode = 200, array $headers = [], $body = 'Hello World', \Closure $customizer = null)
     {
         $this->kernel = new TestHttpKernel($body, $statusCode, $headers, $customizer);
     }
@@ -164,7 +168,7 @@ class HttpCacheTestCase extends TestCase
 
         $fp = opendir($directory);
         while (false !== $file = readdir($fp)) {
-            if (!in_array($file, array('.', '..'))) {
+            if (!\in_array($file, ['.', '..'])) {
                 if (is_link($directory.'/'.$file)) {
                     unlink($directory.'/'.$file);
                 } elseif (is_dir($directory.'/'.$file)) {

vendor/symfony/http-kernel/Tests/HttpCache/ResponseCacheStrategyTest.php

@@ -175,8 +175,26 @@ class ResponseCacheStrategyTest extends TestCase
         $cacheStrategy->update($masterResponse);
 
         $this->assertTrue($masterResponse->headers->hasCacheControlDirective('private'));
-        // Not sure if we should pass "max-age: 60" in this case, as long as the response is private and
-        // that's the more conservative of both the master and embedded response...?
+        $this->assertFalse($masterResponse->headers->hasCacheControlDirective('public'));
+    }
+
+    public function testEmbeddingPublicResponseDoesNotMakeMainResponsePublic()
+    {
+        $cacheStrategy = new ResponseCacheStrategy();
+
+        $masterResponse = new Response();
+        $masterResponse->setPrivate(); // this is the default, but let's be explicit
+        $masterResponse->setMaxAge(100);
+
+        $embeddedResponse = new Response();
+        $embeddedResponse->setPublic();
+        $embeddedResponse->setSharedMaxAge(100);
+
+        $cacheStrategy->add($embeddedResponse);
+        $cacheStrategy->update($masterResponse);
+
+        $this->assertTrue($masterResponse->headers->hasCacheControlDirective('private'));
+        $this->assertFalse($masterResponse->headers->hasCacheControlDirective('public'));
     }
 
     public function testResponseIsExiprableWhenEmbeddedResponseCombinesExpiryAndValidation()
@@ -198,7 +216,7 @@ class ResponseCacheStrategyTest extends TestCase
         $cacheStrategy->add($embeddedResponse);
         $cacheStrategy->update($masterResponse);
 
-        $this->assertSame('60', $masterResponse->headers->getCacheControlDirective('s-maxage'));
+        $this->assertEqualsWithDelta(60, (int) $masterResponse->headers->getCacheControlDirective('s-maxage'), 1);
     }
 
     public function testResponseIsExpirableButNotValidateableWhenMasterResponseCombinesExpirationAndValidation()
@@ -219,4 +237,233 @@ class ResponseCacheStrategyTest extends TestCase
         $this->assertSame('60', $masterResponse->headers->getCacheControlDirective('s-maxage'));
         $this->assertFalse($masterResponse->isValidateable());
     }
+
+    /**
+     * @dataProvider cacheControlMergingProvider
+     */
+    public function testCacheControlMerging(array $expects, array $master, array $surrogates)
+    {
+        $cacheStrategy = new ResponseCacheStrategy();
+        $buildResponse = function ($config) {
+            $response = new Response();
+
+            foreach ($config as $key => $value) {
+                switch ($key) {
+                    case 'age':
+                        $response->headers->set('Age', $value);
+                        break;
+
+                    case 'expires':
+                        $expires = clone $response->getDate();
+                        $expires->modify('+'.$value.' seconds');
+                        $response->setExpires($expires);
+                        break;
+
+                    case 'max-age':
+                        $response->setMaxAge($value);
+                        break;
+
+                    case 's-maxage':
+                        $response->setSharedMaxAge($value);
+                        break;
+
+                    case 'private':
+                        $response->setPrivate();
+                        break;
+
+                    case 'public':
+                        $response->setPublic();
+                        break;
+
+                    default:
+                        $response->headers->addCacheControlDirective($key, $value);
+                }
+            }
+
+            return $response;
+        };
+
+        foreach ($surrogates as $config) {
+            $cacheStrategy->add($buildResponse($config));
+        }
+
+        $response = $buildResponse($master);
+        $cacheStrategy->update($response);
+
+        foreach ($expects as $key => $value) {
+            if ('expires' === $key) {
+                $this->assertSame($value, $response->getExpires()->format('U') - $response->getDate()->format('U'));
+            } elseif ('age' === $key) {
+                $this->assertSame($value, $response->getAge());
+            } elseif (true === $value) {
+                $this->assertTrue($response->headers->hasCacheControlDirective($key), sprintf('Cache-Control header must have "%s" flag', $key));
+            } elseif (false === $value) {
+                $this->assertFalse(
+                    $response->headers->hasCacheControlDirective($key),
+                    sprintf('Cache-Control header must NOT have "%s" flag', $key)
+                );
+            } else {
+                $this->assertSame($value, $response->headers->getCacheControlDirective($key), sprintf('Cache-Control flag "%s" should be "%s"', $key, $value));
+            }
+        }
+    }
+
+    public function cacheControlMergingProvider()
+    {
+        yield 'result is public if all responses are public' => [
+            ['private' => false, 'public' => true],
+            ['public' => true],
+            [
+                ['public' => true],
+            ],
+        ];
+
+        yield 'result is private by default' => [
+            ['private' => true, 'public' => false],
+            ['public' => true],
+            [
+                [],
+            ],
+        ];
+
+        yield 'combines public and private responses' => [
+            ['must-revalidate' => false, 'private' => true, 'public' => false],
+            ['public' => true],
+            [
+                ['private' => true],
+            ],
+        ];
+
+        yield 'inherits no-cache from surrogates' => [
+            ['no-cache' => true, 'public' => false],
+            ['public' => true],
+            [
+                ['no-cache' => true],
+            ],
+        ];
+
+        yield 'inherits no-store from surrogate' => [
+            ['no-store' => true, 'public' => false],
+            ['public' => true],
+            [
+                ['no-store' => true],
+            ],
+        ];
+
+        yield 'resolve to lowest possible max-age' => [
+            ['public' => false, 'private' => true, 's-maxage' => false, 'max-age' => '60'],
+            ['public' => true, 'max-age' => 3600],
+            [
+                ['private' => true, 'max-age' => 60],
+            ],
+        ];
+
+        yield 'resolves multiple max-age' => [
+            ['public' => false, 'private' => true, 's-maxage' => false, 'max-age' => '60'],
+            ['private' => true, 'max-age' => 100],
+            [
+                ['private' => true, 'max-age' => 3600],
+                ['public' => true, 'max-age' => 60, 's-maxage' => 60],
+                ['private' => true, 'max-age' => 60],
+            ],
+        ];
+
+        yield 'merge max-age and s-maxage' => [
+            ['public' => true, 's-maxage' => '60', 'max-age' => null],
+            ['public' => true, 's-maxage' => 3600],
+            [
+                ['public' => true, 'max-age' => 60],
+            ],
+        ];
+
+        yield 'result is private when combining private responses' => [
+            ['no-cache' => false, 'must-revalidate' => false, 'private' => true],
+            ['s-maxage' => 60, 'private' => true],
+            [
+                ['s-maxage' => 60, 'private' => true],
+            ],
+        ];
+
+        yield 'result can have s-maxage and max-age' => [
+            ['public' => true, 'private' => false, 's-maxage' => '60', 'max-age' => '30'],
+            ['s-maxage' => 100, 'max-age' => 2000],
+            [
+                ['s-maxage' => 1000, 'max-age' => 30],
+                ['s-maxage' => 500, 'max-age' => 500],
+                ['s-maxage' => 60, 'max-age' => 1000],
+            ],
+        ];
+
+        yield 'does not set headers without value' => [
+            ['max-age' => null, 's-maxage' => null, 'public' => null],
+            ['private' => true],
+            [
+                ['private' => true],
+            ],
+        ];
+
+        yield 'max-age 0 is sent to the client' => [
+            ['private' => true, 'max-age' => '0'],
+            ['max-age' => 0, 'private' => true],
+            [
+                ['max-age' => 60, 'private' => true],
+            ],
+        ];
+
+        yield 'max-age is relative to age' => [
+            ['max-age' => '240', 'age' => 60],
+            ['max-age' => 180],
+            [
+                ['max-age' => 600, 'age' => 60],
+            ],
+        ];
+
+        yield 'retains lowest age of all responses' => [
+            ['max-age' => '160', 'age' => 60],
+            ['max-age' => 600, 'age' => 60],
+            [
+                ['max-age' => 120, 'age' => 20],
+            ],
+        ];
+
+        yield 'max-age can be less than age, essentially expiring the response' => [
+            ['age' => 120, 'max-age' => '90'],
+            ['max-age' => 90, 'age' => 120],
+            [
+                ['max-age' => 120, 'age' => 60],
+            ],
+        ];
+
+        yield 'max-age is 0 regardless of age' => [
+            ['max-age' => '0'],
+            ['max-age' => 60],
+            [
+                ['max-age' => 0, 'age' => 60],
+            ],
+        ];
+
+        yield 'max-age is not negative' => [
+            ['max-age' => '0'],
+            ['max-age' => 0],
+            [
+                ['max-age' => 0, 'age' => 60],
+            ],
+        ];
+
+        yield 'calculates lowest Expires header' => [
+            ['expires' => 60],
+            ['expires' => 60],
+            [
+                ['expires' => 120],
+            ],
+        ];
+
+        yield 'calculates Expires header relative to age' => [
+            ['expires' => 210, 'age' => 120],
+            ['expires' => 90],
+            [
+                ['expires' => 600, 'age' => '120'],
+            ],
+        ];
+    }
 }

vendor/symfony/http-kernel/Tests/HttpCache/SsiTest.php

@@ -120,11 +120,9 @@ class SsiTest extends TestCase
         $this->assertEquals('<?php echo "<?"; ?>php <?php echo "<?"; ?> <?php echo "<%"; ?> <?php echo "<s"; ?>cript language=php>', $response->getContent());
     }
 
-    /**
-     * @expectedException \RuntimeException
-     */
     public function testProcessWhenNoSrcInAnSsi()
     {
+        $this->expectException('RuntimeException');
         $ssi = new Ssi();
 
         $request = Request::create('/');
@@ -160,11 +158,9 @@ class SsiTest extends TestCase
         $this->assertEquals('foo', $ssi->handle($cache, '/', '/alt', true));
     }
 
-    /**
-     * @expectedException \RuntimeException
-     */
     public function testHandleWhenResponseIsNot200()
     {
+        $this->expectException('RuntimeException');
         $ssi = new Ssi();
         $response = new Response('foo');
         $response->setStatusCode(404);
@@ -187,26 +183,26 @@ class SsiTest extends TestCase
         $response1 = new Response('foo');
         $response1->setStatusCode(404);
         $response2 = new Response('bar');
-        $cache = $this->getCache(Request::create('/'), array($response1, $response2));
+        $cache = $this->getCache(Request::create('/'), [$response1, $response2]);
         $this->assertEquals('bar', $ssi->handle($cache, '/', '/alt', false));
     }
 
     protected function getCache($request, $response)
     {
-        $cache = $this->getMockBuilder('Symfony\Component\HttpKernel\HttpCache\HttpCache')->setMethods(array('getRequest', 'handle'))->disableOriginalConstructor()->getMock();
+        $cache = $this->getMockBuilder('Symfony\Component\HttpKernel\HttpCache\HttpCache')->setMethods(['getRequest', 'handle'])->disableOriginalConstructor()->getMock();
         $cache->expects($this->any())
               ->method('getRequest')
-              ->will($this->returnValue($request))
+              ->willReturn($request)
         ;
-        if (is_array($response)) {
+        if (\is_array($response)) {
             $cache->expects($this->any())
                   ->method('handle')
-                  ->will(call_user_func_array(array($this, 'onConsecutiveCalls'), $response))
+                  ->will(\call_user_func_array([$this, 'onConsecutiveCalls'], $response))
             ;
         } else {
             $cache->expects($this->any())
                   ->method('handle')
-                  ->will($this->returnValue($response))
+                  ->willReturn($response)
             ;
         }
 

vendor/symfony/http-kernel/Tests/HttpCache/StoreTest.php

@@ -29,7 +29,7 @@ class StoreTest extends TestCase
     protected function setUp()
     {
         $this->request = Request::create('/');
-        $this->response = new Response('hello world', 200, array());
+        $this->response = new Response('hello world', 200, []);
 
         HttpCacheTestCase::clearDirectory(sys_get_temp_dir().'/http_cache');
 
@@ -52,7 +52,7 @@ class StoreTest extends TestCase
 
     public function testUnlockFileThatDoesExist()
     {
-        $cacheKey = $this->storeSimpleEntry();
+        $this->storeSimpleEntry();
         $this->store->lock($this->request);
 
         $this->assertTrue($this->store->unlock($this->request));
@@ -92,11 +92,65 @@ class StoreTest extends TestCase
     {
         $cacheKey = $this->storeSimpleEntry();
         $entries = $this->getStoreMetadata($cacheKey);
-        list($req, $res) = $entries[0];
+        list(, $res) = $entries[0];
 
         $this->assertEquals('en9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08', $res['x-content-digest'][0]);
     }
 
+    public function testDoesNotTrustXContentDigestFromUpstream()
+    {
+        $response = new Response('test', 200, ['X-Content-Digest' => 'untrusted-from-elsewhere']);
+
+        $cacheKey = $this->store->write($this->request, $response);
+        $entries = $this->getStoreMetadata($cacheKey);
+        list(, $res) = $entries[0];
+
+        $this->assertEquals('en9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08', $res['x-content-digest'][0]);
+        $this->assertEquals('en9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08', $response->headers->get('X-Content-Digest'));
+    }
+
+    public function testWritesResponseEvenIfXContentDigestIsPresent()
+    {
+        // Prime the store
+        $this->store->write($this->request, new Response('test', 200, ['X-Content-Digest' => 'untrusted-from-elsewhere']));
+
+        $response = $this->store->lookup($this->request);
+        $this->assertNotNull($response);
+    }
+
+    public function testWritingARestoredResponseDoesNotCorruptCache()
+    {
+        /*
+         * This covers the regression reported in https://github.com/symfony/symfony/issues/37174.
+         *
+         * A restored response does *not* load the body, but only keep the file path in a special X-Body-File
+         * header. For reasons (?), the file path was also used as the restored response body.
+         * It would be up to others (HttpCache...?) to honor this header and actually load the response content
+         * from there.
+         *
+         * When a restored response was stored again, the Store itself would ignore the header. In the first
+         * step, this would compute a new Content Digest based on the file path in the restored response body;
+         * this is covered by "Checkpoint 1" below. But, since the X-Body-File header was left untouched (Checkpoint 2), downstream
+         * code (HttpCache...) would not immediately notice.
+         *
+         * Only upon performing the lookup for a second time, we'd get a Response where the (wrong) Content Digest
+         * is also reflected in the X-Body-File header, this time also producing wrong content when the downstream
+         * evaluates it.
+         */
+        $this->store->write($this->request, $this->response);
+        $digest = $this->response->headers->get('X-Content-Digest');
+        $path = $this->getStorePath($digest);
+
+        $response = $this->store->lookup($this->request);
+        $this->store->write($this->request, $response);
+        $this->assertEquals($digest, $response->headers->get('X-Content-Digest')); // Checkpoint 1
+        $this->assertEquals($path, $response->headers->get('X-Body-File')); // Checkpoint 2
+
+        $response = $this->store->lookup($this->request);
+        $this->assertEquals($digest, $response->headers->get('X-Content-Digest'));
+        $this->assertEquals($path, $response->headers->get('X-Body-File'));
+    }
+
     public function testFindsAStoredEntryWithLookup()
     {
         $this->storeSimpleEntry();
@@ -108,7 +162,7 @@ class StoreTest extends TestCase
 
     public function testDoesNotFindAnEntryWithLookupWhenNoneExists()
     {
-        $request = Request::create('/test', 'get', array(), array(), array(), array('HTTP_FOO' => 'Foo', 'HTTP_BAR' => 'Bar'));
+        $request = Request::create('/test', 'get', [], [], [], ['HTTP_FOO' => 'Foo', 'HTTP_BAR' => 'Bar']);
 
         $this->assertNull($this->store->lookup($request));
     }
@@ -137,7 +191,7 @@ class StoreTest extends TestCase
         $this->storeSimpleEntry();
         $response = $this->store->lookup($this->request);
 
-        $this->assertEquals($response->headers->all(), array_merge(array('content-length' => 4, 'x-body-file' => array($this->getStorePath($response->headers->get('X-Content-Digest')))), $this->response->headers->all()));
+        $this->assertEquals($response->headers->all(), array_merge(['content-length' => 4, 'x-body-file' => [$this->getStorePath($response->headers->get('X-Content-Digest'))]], $this->response->headers->all()));
     }
 
     public function testRestoresResponseContentFromEntityStoreWithLookup()
@@ -165,9 +219,9 @@ class StoreTest extends TestCase
 
     public function testDoesNotReturnEntriesThatVaryWithLookup()
     {
-        $req1 = Request::create('/test', 'get', array(), array(), array(), array('HTTP_FOO' => 'Foo', 'HTTP_BAR' => 'Bar'));
-        $req2 = Request::create('/test', 'get', array(), array(), array(), array('HTTP_FOO' => 'Bling', 'HTTP_BAR' => 'Bam'));
-        $res = new Response('test', 200, array('Vary' => 'Foo Bar'));
+        $req1 = Request::create('/test', 'get', [], [], [], ['HTTP_FOO' => 'Foo', 'HTTP_BAR' => 'Bar']);
+        $req2 = Request::create('/test', 'get', [], [], [], ['HTTP_FOO' => 'Bling', 'HTTP_BAR' => 'Bam']);
+        $res = new Response('test', 200, ['Vary' => 'Foo Bar']);
         $this->store->write($req1, $res);
 
         $this->assertNull($this->store->lookup($req2));
@@ -175,9 +229,9 @@ class StoreTest extends TestCase
 
     public function testDoesNotReturnEntriesThatSlightlyVaryWithLookup()
     {
-        $req1 = Request::create('/test', 'get', array(), array(), array(), array('HTTP_FOO' => 'Foo', 'HTTP_BAR' => 'Bar'));
-        $req2 = Request::create('/test', 'get', array(), array(), array(), array('HTTP_FOO' => 'Foo', 'HTTP_BAR' => 'Bam'));
-        $res = new Response('test', 200, array('Vary' => array('Foo', 'Bar')));
+        $req1 = Request::create('/test', 'get', [], [], [], ['HTTP_FOO' => 'Foo', 'HTTP_BAR' => 'Bar']);
+        $req2 = Request::create('/test', 'get', [], [], [], ['HTTP_FOO' => 'Foo', 'HTTP_BAR' => 'Bam']);
+        $res = new Response('test', 200, ['Vary' => ['Foo', 'Bar']]);
         $this->store->write($req1, $res);
 
         $this->assertNull($this->store->lookup($req2));
@@ -185,16 +239,16 @@ class StoreTest extends TestCase
 
     public function testStoresMultipleResponsesForEachVaryCombination()
     {
-        $req1 = Request::create('/test', 'get', array(), array(), array(), array('HTTP_FOO' => 'Foo', 'HTTP_BAR' => 'Bar'));
-        $res1 = new Response('test 1', 200, array('Vary' => 'Foo Bar'));
+        $req1 = Request::create('/test', 'get', [], [], [], ['HTTP_FOO' => 'Foo', 'HTTP_BAR' => 'Bar']);
+        $res1 = new Response('test 1', 200, ['Vary' => 'Foo Bar']);
         $key = $this->store->write($req1, $res1);
 
-        $req2 = Request::create('/test', 'get', array(), array(), array(), array('HTTP_FOO' => 'Bling', 'HTTP_BAR' => 'Bam'));
-        $res2 = new Response('test 2', 200, array('Vary' => 'Foo Bar'));
+        $req2 = Request::create('/test', 'get', [], [], [], ['HTTP_FOO' => 'Bling', 'HTTP_BAR' => 'Bam']);
+        $res2 = new Response('test 2', 200, ['Vary' => 'Foo Bar']);
         $this->store->write($req2, $res2);
 
-        $req3 = Request::create('/test', 'get', array(), array(), array(), array('HTTP_FOO' => 'Baz', 'HTTP_BAR' => 'Boom'));
-        $res3 = new Response('test 3', 200, array('Vary' => 'Foo Bar'));
+        $req3 = Request::create('/test', 'get', [], [], [], ['HTTP_FOO' => 'Baz', 'HTTP_BAR' => 'Boom']);
+        $res3 = new Response('test 3', 200, ['Vary' => 'Foo Bar']);
         $this->store->write($req3, $res3);
 
         $this->assertEquals($this->getStorePath('en'.hash('sha256', 'test 3')), $this->store->lookup($req3)->getContent());
@@ -206,18 +260,18 @@ class StoreTest extends TestCase
 
     public function testOverwritesNonVaryingResponseWithStore()
     {
-        $req1 = Request::create('/test', 'get', array(), array(), array(), array('HTTP_FOO' => 'Foo', 'HTTP_BAR' => 'Bar'));
-        $res1 = new Response('test 1', 200, array('Vary' => 'Foo Bar'));
-        $key = $this->store->write($req1, $res1);
+        $req1 = Request::create('/test', 'get', [], [], [], ['HTTP_FOO' => 'Foo', 'HTTP_BAR' => 'Bar']);
+        $res1 = new Response('test 1', 200, ['Vary' => 'Foo Bar']);
+        $this->store->write($req1, $res1);
         $this->assertEquals($this->getStorePath('en'.hash('sha256', 'test 1')), $this->store->lookup($req1)->getContent());
 
-        $req2 = Request::create('/test', 'get', array(), array(), array(), array('HTTP_FOO' => 'Bling', 'HTTP_BAR' => 'Bam'));
-        $res2 = new Response('test 2', 200, array('Vary' => 'Foo Bar'));
+        $req2 = Request::create('/test', 'get', [], [], [], ['HTTP_FOO' => 'Bling', 'HTTP_BAR' => 'Bam']);
+        $res2 = new Response('test 2', 200, ['Vary' => 'Foo Bar']);
         $this->store->write($req2, $res2);
         $this->assertEquals($this->getStorePath('en'.hash('sha256', 'test 2')), $this->store->lookup($req2)->getContent());
 
-        $req3 = Request::create('/test', 'get', array(), array(), array(), array('HTTP_FOO' => 'Foo', 'HTTP_BAR' => 'Bar'));
-        $res3 = new Response('test 3', 200, array('Vary' => 'Foo Bar'));
+        $req3 = Request::create('/test', 'get', [], [], [], ['HTTP_FOO' => 'Foo', 'HTTP_BAR' => 'Bar']);
+        $res3 = new Response('test 3', 200, ['Vary' => 'Foo Bar']);
         $key = $this->store->write($req3, $res3);
         $this->assertEquals($this->getStorePath('en'.hash('sha256', 'test 3')), $this->store->lookup($req3)->getContent());
 
@@ -226,10 +280,10 @@ class StoreTest extends TestCase
 
     public function testLocking()
     {
-        $req = Request::create('/test', 'get', array(), array(), array(), array('HTTP_FOO' => 'Foo', 'HTTP_BAR' => 'Bar'));
+        $req = Request::create('/test', 'get', [], [], [], ['HTTP_FOO' => 'Foo', 'HTTP_BAR' => 'Bar']);
         $this->assertTrue($this->store->lock($req));
 
-        $path = $this->store->lock($req);
+        $this->store->lock($req);
         $this->assertTrue($this->store->isLocked($req));
 
         $this->store->unlock($req);
@@ -263,14 +317,14 @@ class StoreTest extends TestCase
         $this->assertEmpty($this->getStoreMetadata($requestHttps));
     }
 
-    protected function storeSimpleEntry($path = null, $headers = array())
+    protected function storeSimpleEntry($path = null, $headers = [])
     {
         if (null === $path) {
             $path = '/test';
         }
 
-        $this->request = Request::create($path, 'get', array(), array(), array(), $headers);
-        $this->response = new Response('test', 200, array('Cache-Control' => 'max-age=420'));
+        $this->request = Request::create($path, 'get', [], [], [], $headers);
+        $this->response = new Response('test', 200, ['Cache-Control' => 'max-age=420']);
 
         return $this->store->write($this->request, $this->response);
     }

vendor/symfony/http-kernel/Tests/HttpCache/TestHttpKernel.php

@@ -11,13 +11,13 @@
 
 namespace Symfony\Component\HttpKernel\Tests\HttpCache;
 
-use Symfony\Component\HttpKernel\Controller\ArgumentResolverInterface;
-use Symfony\Component\HttpKernel\HttpKernel;
-use Symfony\Component\HttpKernel\HttpKernelInterface;
+use Symfony\Component\EventDispatcher\EventDispatcher;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\HttpKernel\Controller\ArgumentResolverInterface;
 use Symfony\Component\HttpKernel\Controller\ControllerResolverInterface;
-use Symfony\Component\EventDispatcher\EventDispatcher;
+use Symfony\Component\HttpKernel\HttpKernel;
+use Symfony\Component\HttpKernel\HttpKernelInterface;
 
 class TestHttpKernel extends HttpKernel implements ControllerResolverInterface, ArgumentResolverInterface
 {
@@ -39,15 +39,25 @@ class TestHttpKernel extends HttpKernel implements ControllerResolverInterface,
         parent::__construct(new EventDispatcher(), $this, null, $this);
     }
 
-    public function getBackendRequest()
+    public function assert(\Closure $callback)
     {
-        return $this->backendRequest;
+        $trustedConfig = [Request::getTrustedProxies(), Request::getTrustedHeaderSet()];
+
+        list($trustedProxies, $trustedHeaderSet, $backendRequest) = $this->backendRequest;
+        Request::setTrustedProxies($trustedProxies, $trustedHeaderSet);
+
+        try {
+            $callback($backendRequest);
+        } finally {
+            list($trustedProxies, $trustedHeaderSet) = $trustedConfig;
+            Request::setTrustedProxies($trustedProxies, $trustedHeaderSet);
+        }
     }
 
     public function handle(Request $request, $type = HttpKernelInterface::MASTER_REQUEST, $catch = false)
     {
         $this->catch = $catch;
-        $this->backendRequest = $request;
+        $this->backendRequest = [Request::getTrustedProxies(), Request::getTrustedHeaderSet(), $request];
 
         return parent::handle($request, $type, $catch);
     }
@@ -59,12 +69,12 @@ class TestHttpKernel extends HttpKernel implements ControllerResolverInterface,
 
     public function getController(Request $request)
     {
-        return array($this, 'callController');
+        return [$this, 'callController'];
     }
 
     public function getArguments(Request $request, $controller)
     {
-        return array($request);
+        return [$request];
     }
 
     public function callController(Request $request)

vendor/symfony/http-kernel/Tests/HttpCache/TestMultipleHttpKernel.php

@@ -11,19 +11,19 @@
 
 namespace Symfony\Component\HttpKernel\Tests\HttpCache;
 
-use Symfony\Component\HttpKernel\Controller\ArgumentResolverInterface;
-use Symfony\Component\HttpKernel\HttpKernel;
-use Symfony\Component\HttpKernel\HttpKernelInterface;
+use Symfony\Component\EventDispatcher\EventDispatcher;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\HttpKernel\Controller\ArgumentResolverInterface;
 use Symfony\Component\HttpKernel\Controller\ControllerResolverInterface;
-use Symfony\Component\EventDispatcher\EventDispatcher;
+use Symfony\Component\HttpKernel\HttpKernel;
+use Symfony\Component\HttpKernel\HttpKernelInterface;
 
 class TestMultipleHttpKernel extends HttpKernel implements ControllerResolverInterface, ArgumentResolverInterface
 {
-    protected $bodies = array();
-    protected $statuses = array();
-    protected $headers = array();
+    protected $bodies = [];
+    protected $statuses = [];
+    protected $headers = [];
     protected $called = false;
     protected $backendRequest;
 
@@ -52,12 +52,12 @@ class TestMultipleHttpKernel extends HttpKernel implements ControllerResolverInt
 
     public function getController(Request $request)
     {
-        return array($this, 'callController');
+        return [$this, 'callController'];
     }
 
     public function getArguments(Request $request, $controller)
     {
-        return array($request);
+        return [$request];
     }
 
     public function callController(Request $request)