Req #81646 [NEW]: header() can violate HTTP RFC

From: ive_jihwan at kaist dot ac dot kr Operating system: any PHP version: 8.0.13 Package: *Network Functions Bug Type: Feature/Change Request Bug description:header() can violate HTTP RFC Description: ------------ RFC7230, which is released in June 2014, explicitly specifies HTTP-version field as starting with "HTTP" case-sensitively. https://datatracker.ietf.org/doc/html/rfc7230#section-2.6 However, PHP's header() function compares first 5 bytes with "HTTP/" case insensitively, and copies whole input line to output message line. This let clients misunderstand HTTP version. https://github.com/php/php-src/blob/master/main/SAPI.c#L755 It can be patched by fixing starting 4 bytes as uppercase "HTTP" or change strncasecmp to strncmp which drops a support standards before RFC7230. Test script: --------------- <?php header("http/1.1 200 OK"); Expected result: ---------------- Either of followings. - header() throws an warning/error that notices HTTP/1.1 or higher must use uppercase "HTTP" - Internally convert to uppercase HTTP Actual result: -------------- (Raw HTTP response message) http/1.1 200 OK Date: Sun, 21 Nov 2021 06:38:10 GMT Connection: close X-Powered-By: PHP/8.0.13 Content-type: text/html; charset=UTF-8 (curl in verbose, downgraded HTTP1.0) > GET /http11.php HTTP/1.1 > Host: localhost:1234 > User-Agent: curl/7.68.0 > Accept: */* > * HTTP 1.0, assume close after body < http/1.1 200 OK < Host: localhost:1234 < Date: Sun, 21 Nov 2021 06:35:19 GMT < Connection: close < X-Powered-By: PHP/8.0.13 < Content-type: text/html; charset=UTF-8 (Chrome) Translate it as HTTP/1.1 (Safari) Translate it as HTTP/1.1 (Firefox) Fail to translate it as valid HTTP For browser screenshots, here is a link: https://imgur.com/a/PtrmfTA -- Edit bug report at https://bugs.php.net/bug.php?id=81646&edit=1 -- Fix committed: https://bugs.php.net/fix.php?id=81646&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=81646&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=81646&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=81646&r=needscript Try newer version: https://bugs.php.net/fix.php?id=81646&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=81646&r=support Expected behavior: https://bugs.php.net/fix.php?id=81646&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=81646&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=81646&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=81646&r=globals PHP version support discontinued: https://bugs.php.net/fix.php?id=81646&r=phptooold Daylight Savings: https://bugs.php.net/fix.php?id=81646&r=dst IIS Stability: https://bugs.php.net/fix.php?id=81646&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=81646&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=81646&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=81646&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=81646&r=mysqlcfg