Sjoerd Langkemper ha scritto:
> >> I propose to not allow newlines in header values.

I started on the implementation for this: 
https://github.com/php/php-src/pull/22651. Besides checking for newlines, it 
also throws an error on NUL bytes.

> Curl specifically documents:
> 
> > ... libcurl passes on 
> > the verbatim strings you give it, without any filter or other safe 
> > guards. That includes white space and control characters.

This documentation is not totally accurate. With HTTP/2 you could technically 
send a header with newlines in it, but cURL still splits a value with newlines 
into multiple headers. So it does not pass on "the verbatim strings you give 
it".

cURL doesn't do input validation regarding this, but documents that you should 
not call it with newlines in headers. So I think it makes sense to check for 
that in PHP.

I also understand Matteo's point that this breaks the hypothetical legitimate 
use of newlines in headers, but even so I would prefer throwing a value error 
on headers with newlines.

So this probably needs an RFC?

Regards,

Sjoerd

Reply via email to