Re: HTTP Response Splitting

From:	Christian Schneider	Date:	Mon, 11 Oct 2004 22:32:36 +0000
Subject:	Re: HTTP Response Splitting
References:	1 2	Groups:	php.internals
Request:	Send a blank email to internals+get-13262@lists.php.net to get a copy of this message

Sascha Schumann wrote:

    response header.  There are also some SAPI modules which
    specifically expect exactly one header per call.  As such,
    stripping off \n.* seems correct to me.

The HTTP standard allows header field folding (CR/LF followed by at least one whitespace on the next line), i.e.: X-Some-Header: key1=value1;<CR><LF> key2=value2; is the same as X-Some-Header: key1=value1; key2=value2; and that's why my patch just replaces the CRs/LFs to spaces to unfold the lines again. This won't break folded lines but will still defang malicious header splitting. - Chris