Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:57665
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 74.125.82.170 as permitted sender)
Message-ID: <4F2C4743.8070609@gmail.com>
Date: Fri, 03 Feb 2012 21:44:51 +0100
User-Agent: Thunderbird
MIME-Version: 1.0
To: Gustavo Lopes <glopes@nebm.ist.utl.pt>
CC: internals@lists.php.net
References: <D5EC076D-8518-4CDC-913F-5A3F3BB97367@sektioneins.de> <op.v83qfyebidpuyk@slws007.slhq.int> <op.v83vw0bcidpuyk@slws007.slhq.int>
In-Reply-To: <op.v83vw0bcidpuyk@slws007.slhq.int>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] The case of HTTP response splitting protection in PHP
From: keisial@gmail.com (=?UTF-8?B?w4FuZ2VsIEdvbnrDoWxleg==?=)

On 03/02/12 15:01, Gustavo Lopes wrote:
> I've committed a different version that also forbids \0 (since, as
> Stefan says, a NUL byte can result in the truncation of the rest of
> the header) and that accepts a CRLF:
>
> http://svn.php.net/viewvc/php/php-src/trunk/main/SAPI.c?r1=323043&r2=323042&pathrev=323043
>

Looks good. But given that the goal is to make this robust, I would go
further:
a) Replace any CRLF + [ \r] with SP
(rfc2616 allows us "A recipient MAY replace any linear white space
with a single SP before forwarding the message downstream.", and
this also protects UAs not following the spec)

b) Bail out on any header_line[i] < ' ' (ie. fail on any special char)



> If you or anyone else find any problem, please report a bug; otherwise
> I'll merge to 5.3 and 5.4 once 5.4 is out of code freeze.
>
> Thanks 
As it's a security patch and of small scope, I would consider it for
5.4. Stas, David?