Re: The case of HTTP response splitting protection in PHP

From:	Gustavo Lopes	Date:	Sat, 04 Feb 2012 11:26:14 +0000
Subject:	Re: The case of HTTP response splitting protection in PHP
References:	1 2 3 4 5	Groups:	php.internals
Request:	Send a blank email to internals+get-57697@lists.php.net to get a copy of this message

On Fri, 03 Feb 2012 14:00:11 -0800, Stas Malyshev wrote:

Hi!
As it's a security patch and of small scope, I would consider it for 5.4. Stas, David?
Do we have unit tests for this code? The fix involves changes in header sending so it may have impact on lots of code. Changes like this can be dangerous. I'm thinking maybe we should wait with it until 5.4.1.

This bug has now four tests and there are some other tests than include calls to header(). That said, I wouldn't consider this critical. This is only relevant if the programmer included user data in the header without validation. -- Gustavo Lopes