Re: multiline HTTP headers support in header()

On Thu, Jul 3, 2014 at 2:36 AM, Solar Designer <solar@openwall.com> wrote: > Hi, > > Please drop multiline HTTP headers support from PHP header() because it > was never needed in that layer, it is a security risk in combination > with a certain IE bug, IE didn't support such multiline response headers > properly anyway, and they are deprecated by RFC 7230: > > https://twitter.com/d0znpp/status/483147480843186176 > > http://lab.onsec.ru/2012/08/php-multiple-headers-bypass-available.html > http://tools.ietf.org/html/rfc7230#section-3.2.4 > > I brought this to Pierre Joye's attention on Twitter today, and he > agrees that "yes it should be removed" and asked me to "drop a mail to > internals". So I just did. > > Alexander > > -- > PHP Internals - PHP Runtime Development Mailing List > To unsubscribe, visit: http://www.php.net/unsub.php > > maybe I'm missing something here, but we don't really "support" multiline headers with header() anymore since 5.1.2, but from time to time this issue resurfaces, mostly because some browsers split header lines on other characters (https://bugs.php.net/bug.php?id=60227 and http://lab.onsec.ru/2012/08/php-multiple-headers-bypass-available.html) than we originally assumed or what the RFC 2616 allows. so I'm not sure how could we fix this other than a one-by-one basis when we find another browser quirk like this. -- Ferenc Kovács @Tyr43l - http://tyrael.hu