Re: Disallow newlines in CURLOPT_HTTPHEADER

Sjoerd Langkemper ha scritto: > >> I propose to not allow newlines in header values. I started on the implementation for this: https://github.com/php/php-src/pull/22651. Besides checking for newlines, it also throws an error on NUL bytes. > Curl specifically documents: > > > ... libcurl passes on > > the verbatim strings you give it, without any filter or other safe > > guards. That includes white space and control characters. This documentation is not totally accurate. With HTTP/2 you could technically send a header with newlines in it, but cURL still splits a value with newlines into multiple headers. So it does not pass on "the verbatim strings you give it". cURL doesn't do input validation regarding this, but documents that you should not call it with newlines in headers. So I think it makes sense to check for that in PHP. I also understand Matteo's point that this breaks the hypothetical legitimate use of newlines in headers, but even so I would prefer throwing a value error on headers with newlines. So this probably needs an RFC? Regards, Sjoerd