Merge pull request #55316 from nextcloud/backport/55283/stable32

[stable32] fix(workflowenigne): stricter length header handling

Author: nickvergessen

apps/workflowengine/lib/Check/FileSize.php

@@ -67,25 +67,35 @@ public function validateCheck($operator, $value) {
 	}
 
 	/**
-	 * @return string
+	 * Gets the file size from HTTP headers.
+	 *
+	 * Checks 'OC-Total-Length' first; if unavailable and the method is POST or PUT,
+	 * checks 'Content-Length'. Returns the size as int, float, or false if not found or invalid.
+	 *
+	 * @return int|float|false File size in bytes, or false if unavailable.
 	 */
 	protected function getFileSizeFromHeader() {
 		if ($this->size !== null) {
+			// Already have it cached?
 			return $this->size;
 		}
 
 		$size = $this->request->getHeader('OC-Total-Length');
 		if ($size === '') {
-			if (in_array($this->request->getMethod(), ['POST', 'PUT'])) {
+			// Try fallback for upload methods
+			$method = $this->request->getMethod();
+			if (in_array($method, ['POST', 'PUT'], true)) {
 				$size = $this->request->getHeader('Content-Length');
 			}
 		}
 
-		if ($size === '') {
-			$size = false;
+		if ($size !== '' && is_numeric($size)) {
+			$this->size = Util::numericToNumber($size);
+		} else {
+			// No valid size header found
+			$this->size = false;
 		}
 
-		$this->size = $size;
 		return $this->size;
 	}
 

build/psalm-baseline.xml

@@ -2748,20 +2748,6 @@
       <code><![CDATA[null]]></code>
     </NullArgument>
   </file>
-  <file src="apps/workflowengine/lib/Check/FileSize.php">
-    <FalsableReturnStatement>
-      <code><![CDATA[$this->size]]></code>
-    </FalsableReturnStatement>
-    <InvalidPropertyAssignmentValue>
-      <code><![CDATA[$size]]></code>
-    </InvalidPropertyAssignmentValue>
-    <InvalidReturnStatement>
-      <code><![CDATA[$this->size]]></code>
-    </InvalidReturnStatement>
-    <InvalidReturnType>
-      <code><![CDATA[string]]></code>
-    </InvalidReturnType>
-  </file>
   <file src="apps/workflowengine/lib/Check/RequestRemoteAddress.php">
     <InvalidArgument>
       <code><![CDATA[$decodedValue[1]]]></code>