note 117189 added to function.get-headers

Note that get_headers should not be used against a URL that was gathered via user input. The timeout option in the stream context only affects the idle time between data in the stream. It does not affect connection time or the overall time of the request. (Unfortunately, this is not mentioned in the docs for the timeout option, but has been discussed in a number of code discussions elsewhere, and I have done my own tests to confirm the conclusions of those discussions.) Thus it is very easy for a user to give you a URL that acts like a Slowloris attack - feeding your get_headers function 1 header only often enough to avoid the stream timeout. If you are publishing your code, even default_socket_timeout cannot be relied on to remedy this, because it is broken for the HTTPS protocol on many but the more recent versions of PHP: https://bugs.php.net/bug.php?id=41631 With get_headers accepting user input, it can be very easy for an attacker to make all of your PHP child processes become busy. Instead, use cURL functions to get headers for a URL provided by the user and parse those headers manually, as CURLOPT_TIMEOUT applies to the entire request. ---- Server IP: 72.52.91.14 Probable Submitter: 100.37.197.166 ---- Manual Page -- http://php.net/manual/en/function.get-headers.php Edit -- https://master.php.net/note/edit/117189 Del: integrated -- https://master.php.net/note/delete/117189/integrated Del: useless -- https://master.php.net/note/delete/117189/useless Del: bad code -- https://master.php.net/note/delete/117189/bad+code Del: spam -- https://master.php.net/note/delete/117189/spam Del: non-english -- https://master.php.net/note/delete/117189/non-english Del: in docs -- https://master.php.net/note/delete/117189/in+docs Del: other reasons-- https://master.php.net/note/delete/117189 Reject -- https://master.php.net/note/reject/117189 Search -- https://master.php.net/manage/user-notes.php