Hi,
Il 09/07/2026 10:17, Sjoerd Langkemper ha scritto:
This is not supported behavior by cURL, and it is a security risk when a
header value is under control of an attacker: they can inject arbitrary
headers to the request.
I propose to not allow newlines in header values. Any thoughts on
this? Should this first raise a deprecation warning before throwing a
value error? I haven't added this to the deprecation RFC as I thought
that is being finalized and made ready for voting soon.
"\r\n" inside headers used to be perfectly legal for multiline headers.
It is now obsolete, but I'm not sure why we should prevent it, if curl
does not.
See:
https://www.rfc-editor.org/info/rfc9112/#name-obsolete-line-folding
Cheers
--
Matteo Beccati
