Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:57656 Return-Path: Mailing-List: contact internals-help@lists.php.net; run by ezmlm Delivered-To: mailing list internals@lists.php.net Received: (qmail 20001 invoked from network); 3 Feb 2012 11:21:42 -0000 Received: from unknown (HELO lists.php.net) (127.0.0.1) by localhost with SMTP; 3 Feb 2012 11:21:42 -0000 Authentication-Results: pb1.pair.com header.from=glopes@nebm.ist.utl.pt; sender-id=unknown Authentication-Results: pb1.pair.com smtp.mail=glopes@nebm.ist.utl.pt; spf=permerror; sender-id=unknown Received-SPF: error (pb1.pair.com: domain nebm.ist.utl.pt from 193.136.128.21 cause and error) X-PHP-List-Original-Sender: glopes@nebm.ist.utl.pt X-Host-Fingerprint: 193.136.128.21 smtp1.ist.utl.pt Linux 2.6 Received: from [193.136.128.21] ([193.136.128.21:36624] helo=smtp1.ist.utl.pt) by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP id E9/01-11798-443CB2F4 for ; Fri, 03 Feb 2012 06:21:41 -0500 Received: from localhost (localhost.localdomain [127.0.0.1]) by smtp1.ist.utl.pt (Postfix) with ESMTP id 2484470003F5 for ; Fri, 3 Feb 2012 11:21:37 +0000 (WET) X-Virus-Scanned: by amavisd-new-2.6.4 (20090625) (Debian) at ist.utl.pt Received: from smtp1.ist.utl.pt ([127.0.0.1]) by localhost (smtp1.ist.utl.pt [127.0.0.1]) (amavisd-new, port 10025) with LMTP id 0sxiNuTCrWjL for ; Fri, 3 Feb 2012 11:21:36 +0000 (WET) Received: from mail2.ist.utl.pt (mail.ist.utl.pt [IPv6:2001:690:2100:1::8]) by smtp1.ist.utl.pt (Postfix) with ESMTP id D223370003F8 for ; Fri, 3 Feb 2012 11:21:35 +0000 (WET) Received: from slws007.slhq.int (a79-168-248-114.cpe.netcabo.pt [79.168.248.114]) (Authenticated sender: ist155741) by mail2.ist.utl.pt (Postfix) with ESMTPSA id 2D0202025891 for ; Fri, 3 Feb 2012 11:21:35 +0000 (WET) Content-Type: text/plain; charset=utf-8; format=flowed; delsp=yes To: internals@lists.php.net References: Date: Fri, 03 Feb 2012 12:21:32 +0100 MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Organization: =?utf-8?Q?N=C3=BAcleo_de_Eng=2E_Biom=C3=A9di?= =?utf-8?Q?ca_do_I=2ES=2ET=2E?= Message-ID: In-Reply-To: User-Agent: Opera Mail/11.61 (Win32) Subject: Re: [PHP-DEV] The case of HTTP response splitting protection in PHP From: glopes@nebm.ist.utl.pt ("Gustavo Lopes") On Fri, 03 Feb 2012 12:06:26 +0100, Stefan Esser wrote: > [snip] > > Luckily it is not affecting everyone, because at least the Apache SAPI > will stop sending the header at the NUL byte, too. > However everybody running CGI/FastCGI will loose the protection with > this. > [snip] Good point, and I humbly take the blame as I simply assumed the header was being passed as a C string (odd that they aren't since NULL bytes are not allowed in headers anyway but besides the point). -- Gustavo Lopes