Re: The case of HTTP response splitting protection in PHP
| From: | Ángel González | Date: | Sat, 04 Feb 2012 15:35:04 +0000 |
| Subject: | Re: The case of HTTP response splitting protection in PHP | ||
| References: | 1 2 3 4 5 6 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-57702@lists.php.net to get a copy of this message | ||
Gustavo Lopes wrote:
> On Sat, 04 Feb 2012 00:06:45 +0100, Ángel González wrote:
>> I've gone ahead and written code for that feature. Comments welcome.
>
> The comparison has a problem: if char is signed (the most common
> scenario), you'll be making a signed comparison, so any character over
> 0x7f will match (if it's an unsigned char, though, it will work,
> because of the integer promotions and usual arithmetic conversions).
> It suffices to replace ' ' with 0x20U.
Yes. I woke up this morning thinking on it. That the line should have been
if ((unsigned char)header_line[i] < 32) {
I wouldn't have thought on using 0x20U instead of 32, but it seems that
it would work, too.
> Other than that, I am a little uncertain about the impact of this
> strictness could have on current applications, even if if correct.
In my humble opinion, there won't be applications using header
continuation. PHP could even define that header() would only
accept a single header with no line continuation with very little impact.