Bug #52979 [Opn->Bgs]: ini variable user_agent allows arbitrary injection
Edit report at http://bugs.php.net/bug.php?id=52979&edit=1
ID: 52979
Updated by: iliaa@php.net
Reported by: marco at vmsoft-gbr dot de
Summary: ini variable user_agent allows arbitrary injection
-Status: Open
+Status: Bogus
Type: Bug
Package: Streams related
Operating System: all
PHP Version: 5.3.3
Block user comment: N
Private report: N
New Comment:
Sorry, but your problem does not imply a bug in PHP itself. For a
list of more appropriate places to ask for help using PHP, please
visit http://www.php.net/support.php as this bug system
is not the
appropriate forum for asking support questions. Due to the volume
of reports we can not explain in detail here why your report is not
a bug. The support channels will be able to provide an explanation
for you.
Thank you for your interest in PHP.
It is a code bug, if injection occurs into your code the problem is with
the code
itself.
Previous Comments:
------------------------------------------------------------------------
[2010-10-03 15:10:22] marco at vmsoft-gbr dot de
The patch sanitizes the user_agent ini variable, so that this can't be
exploited any more. It also gives out a warning so people update their
buggy scripts.
------------------------------------------------------------------------
[2010-10-03 15:08:01] marco at vmsoft-gbr dot de
Cut out the "ini_set('user_agent', "PHPX-MyCustomHeader: Foo");" in
the
testscript, this was a copy mistake
------------------------------------------------------------------------
[2010-10-03 15:06:16] marco at vmsoft-gbr dot de
Description:
------------
The php.ini variable user_agent is not properly sanitized. This allows
arbitrary header injection for any HTTP(S) request made using the http
stream wrapper (see code). This bug has grown a feature, but now using
stream_context_set_option this behaviour should be deprecated.
Test script:
---------------
<?php
// before, insecure:
ini_set('user_agent', "PHP\r\nX-MyCustomHeader: Foo");
$f=file_get_contents('http://www.example.com/index.php');
// now, proper way of adding headers:
$s=stream_context_create();
stream_context_set_option($s,"http","header","X-MyCustomHeader: Foo");
ini_set('user_agent', "PHPX-MyCustomHeader: Foo");
$f=file_get_contents('http://www.example.com/index.php',false,$s);
?>
------------------------------------------------------------------------
--
Edit this bug report at http://bugs.php.net/bug.php?id=52979&edit=1
Thread (4 messages)