Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:57695
Return-Path: <nikita.ppv@googlemail.com>
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Delivered-To: mailing list internals@lists.php.net
Received: (qmail 12049 invoked from network); 4 Feb 2012 10:35:41 -0000
Received: from unknown (HELO lists.php.net) (127.0.0.1)
  by localhost with SMTP; 4 Feb 2012 10:35:41 -0000
Authentication-Results: pb1.pair.com smtp.mail=nikita.ppv@googlemail.com; spf=pass; sender-id=pass
Authentication-Results: pb1.pair.com header.from=nikita.ppv@googlemail.com; sender-id=pass
Received-SPF: pass (pb1.pair.com: domain googlemail.com designates 209.85.217.170 as permitted sender)
X-PHP-List-Original-Sender: nikita.ppv@googlemail.com
X-Host-Fingerprint: 209.85.217.170 mail-lpp01m020-f170.google.com  
Received: from [209.85.217.170] ([209.85.217.170:63717] helo=mail-lpp01m020-f170.google.com)
	by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP
	id 27/DC-08838-CF90D2F4 for <internals@lists.php.net>; Sat, 04 Feb 2012 05:35:41 -0500
Received: by lboj14 with SMTP id j14so738050lbo.29
        for <internals@lists.php.net>; Sat, 04 Feb 2012 02:35:37 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=googlemail.com; s=gamma;
        h=mime-version:in-reply-to:references:date:message-id:subject:from:to
         :cc:content-type:content-transfer-encoding;
        bh=1fThu20MfZYqluUaLCbCOLQuHkX0qv3I6clt5HlmQ7w=;
        b=tObAa4IGxR5T6kgZIpg8D9TT3j/Vu+7qOOc86eAh7T7fPX/IJSjcrlkBawqNuzBaMn
         xJSxRT1L54loIb15CtvN87wCcC5oRlXCLHVgeQSV5kUWbOzIew9Gie7V3OEB3+I8Sosr
         AUsVPYPfcu5engBn67kRyq9TYUPX6uMimRZxQ=
MIME-Version: 1.0
Received: by 10.112.100.164 with SMTP id ez4mr2905465lbb.46.1328351737107;
 Sat, 04 Feb 2012 02:35:37 -0800 (PST)
Received: by 10.152.18.166 with HTTP; Sat, 4 Feb 2012 02:35:37 -0800 (PST)
In-Reply-To: <4F2C6885.8080007@gmail.com>
References: <D5EC076D-8518-4CDC-913F-5A3F3BB97367@sektioneins.de>
	<op.v83qfyebidpuyk@slws007.slhq.int>
	<op.v83vw0bcidpuyk@slws007.slhq.int>
	<4F2C4743.8070609@gmail.com>
	<4F2C6885.8080007@gmail.com>
Date: Sat, 4 Feb 2012 11:35:37 +0100
Message-ID: <CAF+90c-5UjQqB5HXSYx_pTwKKmjghDnyRNesmXAXzUzGx8dDpg@mail.gmail.com>
To: =?ISO-8859-1?Q?=C1ngel_Gonz=E1lez?= <keisial@gmail.com>
Cc: Gustavo Lopes <glopes@nebm.ist.utl.pt>, internals@lists.php.net
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] The case of HTTP response splitting protection in PHP
From: nikita.ppv@googlemail.com (Nikita Popov)

On Sat, Feb 4, 2012 at 12:06 AM, =C1ngel Gonz=E1lez <keisial@gmail.com> wro=
te:
> I've gone ahead and written code for that feature. Comments welcome.

If I understand it correctly your code only allows \r\n[ \t] style
line continuations, whereas catahracts previous version allowed
(?>\r\n|\r|\n)[ \t]. Is that intentional?

Nikita