Hi
On 2026-07-09 10:17, Sjoerd Langkemper wrote:
Currently, it is possible to have multiple lines in a HTTP headers in a
cURL request, which then get interpreted as multiple headers:
[…]
This is not supported behavior by cURL, and it is a security risk when
a header value is under control of an attacker: they can inject
arbitrary headers to the request.
I propose to not allow newlines in header values. Any thoughts on this?
Should this first raise a deprecation warning before throwing a value
error? I haven't added this to the deprecation RFC as I thought that is
being finalized and made ready for voting soon.
Ugh. I agree that this is unexpected behavior that enables security
issues and would suggest going straight to ValueError with PHP 8.6.
Since CURLOPT_HTTPHEADER already rejects string inputs:
curl_setopt($ch, CURLOPT_HTTPHEADER, "Hello: world\r\nFoo: bar");
the API already very heavily implies that you are expected to pass
headers as individual array elements - and it's also documented that
way. Thus I would say this falls under the rules in
https://wiki.php.net/rfc/policy-exempt-type-value-error-bc-policy.
Can you send a PR?
Best regards
Tim Düsterhus
