feature #63541 [HttpFoundation] Deprecate setting public properties of Request and Response objects directly (nicolas-grekas)

This PR was merged into the 8.1 branch.

Discussion
----------

[HttpFoundation] Deprecate setting public properties of `Request` and `Response` objects directly

| Q             | A
| ------------- | ---
| Branch?       | 8.1
| Bug fix?      | no
| New feature?  | yes
| Deprecations? | yes
| Issues        | -
| License       | MIT

PHP 8.4 property hooks allow adding a set hook to existing properties without breaking the public API. This PR leverages that to deprecate external direct assignments to Request and Response properties.

The goal is to make our beloved `Request` and `Response` objects safer by using `public private(set)` in 9.0.

That's only for public properties, which are the ones that hold value objects (`ParameterBag`/`HeaderBag`) which shouldn't be reassigned at will.

Commits
-------

8b2209e3972 [HttpFoundation] Deprecate setting public properties of `Request` and `Response` objects directly

Author: nicolas-grekas

HttpClientKernel.php

@@ -55,20 +55,25 @@ public function handle(Request $request, int $type = HttpKernelInterface::MAIN_R
             'body' => $body,
         ] + $request->attributes->get('http_client_options', []));
 
-        $response = new Response($response->getContent(!$catch), $response->getStatusCode(), $response->getHeaders(!$catch));
-
-        $response->headers->remove('X-Body-File');
-        $response->headers->remove('X-Body-Eval');
-        $response->headers->remove('X-Content-Digest');
-
-        $response->headers = new class($response->headers->all()) extends ResponseHeaderBag {
+        $headers = new class($response->getHeaders(!$catch)) extends ResponseHeaderBag {
             protected function computeCacheControlValue(): string
             {
                 return $this->getCacheControlHeader(); // preserve the original value
             }
         };
-
-        return $response;
+        $headers->remove('X-Body-File');
+        $headers->remove('X-Body-Eval');
+        $headers->remove('X-Content-Digest');
+
+        try {
+            return new Response($response->getContent(!$catch), $response->getStatusCode(), $headers);
+        } catch (\TypeError) {
+            // BC with Symfony < 8.1
+            $response = new Response($response->getContent(!$catch), $response->getStatusCode());
+            $response->headers = $headers;
+
+            return $response;
+        }
     }
 
     private function getBody(Request $request): ?AbstractPart

Tests/HttpClientKernelTest.php

@@ -24,8 +24,8 @@ public function testHandlePassesMaxRedirectsHttpClientOption()
         $request = new Request();
         $request->attributes->set('http_client_options', ['max_redirects' => 50]);
 
-        $response = $this->createMock(ResponseInterface::class);
-        $response->expects($this->once())->method('getStatusCode')->willReturn(200);
+        $response = $this->createStub(ResponseInterface::class);
+        $response->method('getStatusCode')->willReturn(200);
 
         $client = $this->createMock(HttpClientInterface::class);
         $client