Re: The case of HTTP response splitting protection in PHP
| From: | Gustavo Lopes | Date: | Fri, 03 Feb 2012 11:21:32 +0000 |
| Subject: | Re: The case of HTTP response splitting protection in PHP | ||
| References: | 1 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-57656@lists.php.net to get a copy of this message | ||
On Fri, 03 Feb 2012 12:06:26 +0100, Stefan Esser <stefan.esser@sektioneins.de> wrote:
[snip] Luckily it is not affecting everyone, because at least the Apache SAPI will stop sending the header at the NUL byte, too. However everybody running CGI/FastCGI will loose the protection with this. [snip]Good point, and I humbly take the blame as I simply assumed the header was being passed as a C string (odd that they aren't since NULL bytes are not allowed in headers anyway but besides the point). -- Gustavo Lopes