Re: Disallow newlines in CURLOPT_HTTPHEADER
| From: | Matteo Beccati | Date: | Thu, 09 Jul 2026 10:49:35 +0000 |
| Subject: | Re: Disallow newlines in CURLOPT_HTTPHEADER | ||
| References: | 1 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-131833@lists.php.net to get a copy of this message | ||
Hi,
Il 09/07/2026 10:17, Sjoerd Langkemper ha scritto:
This is not supported behavior by cURL, and it is a security risk when a header value is under control of an attacker: they can inject arbitrary headers to the request. I propose to not allow newlines in header values. Any thoughts on this? Should this first raise a deprecation warning before throwing a value error? I haven't added this to the deprecation RFC as I thought that is being finalized and made ready for voting soon."\r\n" inside headers used to be perfectly legal for multiline headers. It is now obsolete, but I'm not sure why we should prevent it, if curl does not. See: https://www.rfc-editor.org/info/rfc9112/#name-obsolete-line-folding Cheers -- Matteo Beccati