From c4f6b117068d6b2f0400d83d37a68037733497a3 Mon Sep 17 00:00:00 2001
From: Damodar Lohani <dlohani48@gmail.com>
Date: Tue, 28 Apr 2026 03:54:34 +0000
Subject: [PATCH 1/4] fix: guard DOMDocument::loadHTML against empty body in
 favicon endpoint

Closes CLO-4279
---
 src/Appwrite/Platform/Modules/Avatars/Http/Favicon/Get.php | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/Appwrite/Platform/Modules/Avatars/Http/Favicon/Get.php b/src/Appwrite/Platform/Modules/Avatars/Http/Favicon/Get.php
index a41d0f81da..e2b72d361a 100644
--- a/src/Appwrite/Platform/Modules/Avatars/Http/Favicon/Get.php
+++ b/src/Appwrite/Platform/Modules/Avatars/Http/Favicon/Get.php
@@ -94,9 +94,12 @@ class Get extends Action
             throw new Exception(Exception::AVATAR_REMOTE_URL_FAILED);
         }
 
+        $body = $res->getBody();
         $doc = new DOMDocument();
         $doc->strictErrorChecking = false;
-        @$doc->loadHTML($res->getBody());
+        if ($body !== '') {
+            @$doc->loadHTML($body);
+        }
 
         $links = $doc->getElementsByTagName('link');
         $outputHref = '';

From 9637409831e23b0392dd6343999b4f7096b17875 Mon Sep 17 00:00:00 2001
From: Damodar Lohani <dlohani48@gmail.com>
Date: Tue, 28 Apr 2026 03:54:35 +0000
Subject: [PATCH 2/4] fix: coerce non-string header values in
 Request::getHeader

Closes CLO-4280
---
 src/Appwrite/Utopia/Request.php | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/src/Appwrite/Utopia/Request.php b/src/Appwrite/Utopia/Request.php
index 66ac4ca932..3004392f76 100644
--- a/src/Appwrite/Utopia/Request.php
+++ b/src/Appwrite/Utopia/Request.php
@@ -209,7 +209,11 @@ class Request extends UtopiaRequest
     public function getHeader(string $key, string $default = ''): string
     {
         $headers = $this->getHeaders();
-        return $headers[$key] ?? $default;
+        $value = $headers[$key] ?? $default;
+        if (\is_array($value)) {
+            $value = $value[0] ?? $default;
+        }
+        return \is_string($value) ? $value : $default;
     }
 
     /**

From 30a511692b38e663bc2d5afc2173a94d9cb21006 Mon Sep 17 00:00:00 2001
From: Damodar Lohani <dlohani48@gmail.com>
Date: Tue, 28 Apr 2026 04:15:00 +0000
Subject: [PATCH 3/4] test: add unit coverage for Request::getHeader non-string
 coercion

Refs CLO-4280
---
 tests/unit/Utopia/RequestTest.php | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/tests/unit/Utopia/RequestTest.php b/tests/unit/Utopia/RequestTest.php
index 81e0ead4b3..57ebae6d1e 100644
--- a/tests/unit/Utopia/RequestTest.php
+++ b/tests/unit/Utopia/RequestTest.php
@@ -161,6 +161,37 @@ class RequestTest extends TestCase
         $this->assertSame($secondRoute, $secondRequest->getRoute());
     }
 
+    public function testGetHeaderReturnsStringValue(): void
+    {
+        $this->request->addHeader('referer', 'https://example.com');
+
+        $this->assertSame('https://example.com', $this->request->getHeader('referer'));
+    }
+
+    public function testGetHeaderReturnsDefaultWhenMissing(): void
+    {
+        $this->assertSame('', $this->request->getHeader('referer'));
+        $this->assertSame('fallback', $this->request->getHeader('referer', 'fallback'));
+    }
+
+    public function testGetHeaderCoercesArrayToFirstElement(): void
+    {
+        $swoole = new SwooleRequest();
+        $swoole->header = ['referer' => ['https://a.example', 'https://b.example']];
+        $request = new Request($swoole);
+
+        $this->assertSame('https://a.example', $request->getHeader('referer'));
+    }
+
+    public function testGetHeaderReturnsDefaultWhenValueNotString(): void
+    {
+        $swoole = new SwooleRequest();
+        $swoole->header = ['referer' => 123];
+        $request = new Request($swoole);
+
+        $this->assertSame('fallback', $request->getHeader('referer', 'fallback'));
+    }
+
     /**
      * Helper to attach a route with multiple SDK methods to the request.
      */

From 81321e82d116ab5d7232305676177469fdc38eb8 Mon Sep 17 00:00:00 2001
From: Damodar Lohani <lohanidamodar@users.noreply.github.com>
Date: Tue, 28 Apr 2026 10:05:01 +0545
Subject: [PATCH 4/4] Update
 src/Appwrite/Platform/Modules/Avatars/Http/Favicon/Get.php

Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
---
 src/Appwrite/Platform/Modules/Avatars/Http/Favicon/Get.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/Appwrite/Platform/Modules/Avatars/Http/Favicon/Get.php b/src/Appwrite/Platform/Modules/Avatars/Http/Favicon/Get.php
index e2b72d361a..31ad572f18 100644
--- a/src/Appwrite/Platform/Modules/Avatars/Http/Favicon/Get.php
+++ b/src/Appwrite/Platform/Modules/Avatars/Http/Favicon/Get.php
@@ -97,7 +97,7 @@ class Get extends Action
         $body = $res->getBody();
         $doc = new DOMDocument();
         $doc->strictErrorChecking = false;
-        if ($body !== '') {
+        if (!empty($body)) {
             @$doc->loadHTML($body);
         }