Bug #79265 [NEW]: Improper injection of Host header when using fopen for http requests

From: miguelxpn2 at gmail dot com Operating system: Linux PHP version: master-Git-2020-02-12 (Git) Package: HTTP related Bug Type: Bug Bug description:Improper injection of Host header when using fopen for http requests Description: ------------ If there is any header in the http request that contains the string 'host:' in their value before the actual host header the requests ends up being sent with two headers Host, the one specified by the user and the default one that's injected in case the header wasn't present. Test script: --------------- <?php $opts = array( 'http'=>array( 'method'=>"GET", 'header'=>"RandomHeader: localhost:8080\r\n" . "Cookie: foo=bar\r\n" . "Host: testcustomheader \r\n" ) ); $context = stream_context_create($opts); $fp = fopen('http://myserver.com', 'r', false, $context); fpassthru($fp); Expected result: ---------------- The raw headers should only contain the host header specified by the user that was sent in the context. Actual result: -------------- We get a faulty request with two Host headers instead: GET / HTTP/1.0 Host: myserver.com RandomHeader: localhost:8080 Cookie: foo=bar Host: testcustomhostheader -- Edit bug report at https://bugs.php.net/bug.php?id=79265&edit=1 -- Fix committed: https://bugs.php.net/fix.php?id=79265&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=79265&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=79265&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=79265&r=needscript Try newer version: https://bugs.php.net/fix.php?id=79265&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=79265&r=support Expected behavior: https://bugs.php.net/fix.php?id=79265&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=79265&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=79265&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=79265&r=globals PHP version support discontinued: https://bugs.php.net/fix.php?id=79265&r=phptooold Daylight Savings: https://bugs.php.net/fix.php?id=79265&r=dst IIS Stability: https://bugs.php.net/fix.php?id=79265&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=79265&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=79265&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=79265&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=79265&r=mysqlcfg