[php-src] Issue #24697: sapi/cli: PHP_HTTP_PARSER_STRICT is defined but never referenced, so STRICT_CHECK() is always a no-op
| From: | akku1139 | Date: | Sun, 25 Oct 2026 17:08:52 +0000 |
| Subject: | [php-src] Issue #24697: sapi/cli: PHP_HTTP_PARSER_STRICT is defined but never referenced, so STRICT_CHECK() is always a no-op | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-253187@lists.php.net to get a copy of this message | ||
Issue: https://github.com/php/php-src/issues/24697
Author: akku1139
### Description
The strict-mode switch name differs between the header and the implementation, so all
STRICT_CHECK() sites are compiled out.
The header logic is also inverted: passing -DPHP_HTTP_PARSER_STRICT reduces the value
to 0 instead of enabling strict mode.
As a result, "strict mode" cannot be enabled by any build option.
- Request line ending with bare LF -> 200 (expected: reject)
- Header line ending with bare LF -> 200 (expected: reject)
- Blank line ending with bare LF -> 200 (expected: reject)
- HTTP/9.9 -> 200, and the response status
line echoes "HTTP/9.9 200 OK"
- HTXP/1.1, HXXP/1.1 (protocol name typo) -> 200 (expected: reject)
- HTTP/1.1 without Host -> 200 (expected: 400)
AI Attribution: found by GPT-6 Luna, tested by DeepSeek V4.1 Flash
### PHP Version
```plain
PHP 8.7.0-dev (cli) (built: Oct 26 2026 01:58:06) (NTS)
Copyright © The PHP Group and Contributors
Zend Engine v4.7.0-dev, Copyright © Zend by Perforce
with Zend OPcache v8.7.0-dev, Copyright ©, by Zend by Perforce
```
### Operating System
_No response_