Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:57671
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 74.125.82.54 as permitted sender)
Message-ID: <4F2C63C5.5060705@gmail.com>
Date: Fri, 03 Feb 2012 23:46:29 +0100
User-Agent: Thunderbird
MIME-Version: 1.0
To: Stas Malyshev <smalyshev@sugarcrm.com>
CC: Gustavo Lopes <glopes@nebm.ist.utl.pt>, 
 "internals@lists.php.net" <internals@lists.php.net>
References: <D5EC076D-8518-4CDC-913F-5A3F3BB97367@sektioneins.de> <op.v83qfyebidpuyk@slws007.slhq.int> <op.v83vw0bcidpuyk@slws007.slhq.int> <4F2C4743.8070609@gmail.com> <4F2C58EB.6000907@sugarcrm.com>
In-Reply-To: <4F2C58EB.6000907@sugarcrm.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] The case of HTTP response splitting protection in PHP
From: keisial@gmail.com (=?UTF-8?B?w4FuZ2VsIEdvbnrDoWxleg==?=)

On 03/02/12 23:00, Stas Malyshev wrote:
> Hi!
>
>> As it's a security patch and of small scope, I would consider it for
>> 5.4. Stas, David?
>
> Do we have unit tests for this code? The fix involves changes in header 
> sending so it may have impact on lots of code. Changes like this can be 
> dangerous. I'm thinking maybe we should wait with it until 5.4.1.
PHP_5_4 already contains code banning \n or \r newlines. The one which
could be bypassed by the "\n Header: Foo\r Foo".
Gustavo patch is fixing it to do what was meant to do.
I think that any good application relying on header() to send multiple ones
would fail with the incomplete fix, so I see little difference in
compatibility
with using the full one.