Fix: remove CURLRequest headers sharing from $_SERVER

system/HTTP/CURLRequest.php

@@ -72,6 +72,16 @@ class CURLRequest extends Request
      */
     protected $delay = 0.0;
 
+    /**
+     * Request headers that are not shared between requests.
+     *
+     * @var string[]
+     */
+    private $unsharedHeaders = [
+        'Content-Length',
+        'Content-Type',
+    ];
+
     /**
      * Takes an array of options to set the following possible class properties:
      *
@@ -106,6 +116,11 @@ public function __construct(App $config, URI $uri, ?ResponseInterface $response
      */
     public function request($method, string $url, array $options = []): ResponseInterface
     {
+        // Reset unshared headers
+        foreach ($this->unsharedHeaders as $header) {
+            $this->removeHeader($header);
+        }
+
         $this->parseOptions($options);
 
         $url = $this->prepareURL($url);
@@ -114,6 +129,9 @@ public function request($method, string $url, array $options = []): ResponseInte
 
         $this->send($method, $url);
 
+        // Reset unshared configs
+        unset($this->config['multipart'], $this->config['form_params']);
+
         return $this->response;
     }
 
@@ -350,27 +368,17 @@ public function send(string $method, string $url)
     }
 
     /**
-     * Takes all headers current part of this request and adds them
-     * to the cURL request.
+     * Adds $this->headers to the cURL request.
      */
     protected function applyRequestHeaders(array $curlOptions = []): array
     {
         if (empty($this->headers)) {
-            $this->populateHeaders();
-            // Otherwise, it will corrupt the request
-            $this->removeHeader('Host');
-            $this->removeHeader('Accept-Encoding');
-        }
-
-        $headers = $this->headers();
-
-        if (empty($headers)) {
             return $curlOptions;
         }
 
         $set = [];
 
-        foreach (array_keys($headers) as $name) {
+        foreach (array_keys($this->headers) as $name) {
             $set[] = $name . ': ' . $this->getHeaderLine($name);
         }
 

tests/system/HTTP/CURLRequestTest.php

@@ -176,48 +176,65 @@ public function testOptionsHeaders()
     /**
      * @backupGlobals enabled
      */
-    public function testOptionHeadersUsingPopulate()
+    public function testOptionsHeadersNotUsingPopulate()
     {
         $_SERVER['HTTP_HOST']            = 'site1.com';
         $_SERVER['HTTP_ACCEPT_LANGUAGE'] = 'en-US';
         $_SERVER['HTTP_ACCEPT_ENCODING'] = 'gzip, deflate, br';
 
         $options = [
             'base_uri' => 'http://www.foo.com/api/v1/',
+            'headers'  => [
+                'Host'            => 'www.foo.com',
+                'Accept-Encoding' => '',
+            ],
         ];
+        $request = $this->getRequest($options);
+        $request->get('example');
+        // if headers for the request are defined we use them
+        $this->assertNull($request->header('Accept-Language'));
+        $this->assertSame('www.foo.com', $request->header('Host')->getValue());
+        $this->assertSame('', $request->header('Accept-Encoding')->getValue());
+    }
 
+    public function testHeaderContentLengthNotSharedBetweenRequests()
+    {
+        $options = [
+            'base_uri' => 'http://www.foo.com/api/v1/',
+        ];
         $request = $this->getRequest($options);
+
+        $request->post('example', [
+            'form_params' => [
+                'q' => 'keyword',
+            ],
+        ]);
         $request->get('example');
-        // we fill the Accept-Language header from _SERVER when no headers are defined for the request
-        $this->assertSame('en-US', $request->header('Accept-Language')->getValue());
-        // but we skip Host header - since it would corrupt the request
-        $this->assertNull($request->header('Host'));
-        // and Accept-Encoding
-        $this->assertNull($request->header('Accept-Encoding'));
+
+        $this->assertNull($request->header('Content-Length'));
     }
 
     /**
      * @backupGlobals enabled
      */
-    public function testOptionHeadersNotUsingPopulate()
+    public function testHeaderContentLengthNotSharedBetweenClients()
     {
-        $_SERVER['HTTP_HOST']            = 'site1.com';
-        $_SERVER['HTTP_ACCEPT_LANGUAGE'] = 'en-US';
-        $_SERVER['HTTP_ACCEPT_ENCODING'] = 'gzip, deflate, br';
+        $_SERVER['HTTP_CONTENT_LENGTH'] = '10';
 
         $options = [
             'base_uri' => 'http://www.foo.com/api/v1/',
-            'headers'  => [
-                'Host'            => 'www.foo.com',
-                'Accept-Encoding' => '',
-            ],
         ];
+        $request = $this->getRequest($options);
+        $request->post('example', [
+            'form_params' => [
+                'q' => 'keyword',
+            ],
+        ]);
+
         $request = $this->getRequest($options);
         $request->get('example');
-        // if headers for the request are defined we use them
-        $this->assertNull($request->header('Accept-Language'));
-        $this->assertSame('www.foo.com', $request->header('Host')->getValue());
-        $this->assertSame('', $request->header('Accept-Encoding')->getValue());
+
+        $this->assertNull($request->header('Content-Length'));
     }
 
     public function testOptionsDelay()