Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:57702
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.212.170 as permitted sender)
Message-ID: <4F2D5028.3010302@gmail.com>
Date: Sat, 04 Feb 2012 16:35:04 +0100
User-Agent: Thunderbird
MIME-Version: 1.0
To: Gustavo Lopes <glopes@nebm.ist.utl.pt>, 
 PHP Developers Mailing List <internals@lists.php.net>
References: <D5EC076D-8518-4CDC-913F-5A3F3BB97367@sektioneins.de> <op.v83qfyebidpuyk@slws007.slhq.int> <op.v83vw0bcidpuyk@slws007.slhq.int> <4F2C4743.8070609@gmail.com> <4F2C6885.8080007@gmail.com> <525f07429768fc0057768837f210236c@nebm.ist.utl.pt>
In-Reply-To: <525f07429768fc0057768837f210236c@nebm.ist.utl.pt>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Subject: Re: [PHP-DEV] The case of HTTP response splitting protection in PHP
From: keisial@gmail.com (=?UTF-8?B?w4FuZ2VsIEdvbnrDoWxleg==?=)

Gustavo Lopes wrote:
> On Sat, 04 Feb 2012 00:06:45 +0100, Ángel González wrote:
>> I've gone ahead and written code for that feature. Comments welcome.
>
> The comparison has a problem: if char is signed (the most common
> scenario), you'll be making a signed comparison, so any character over
> 0x7f will match (if it's an unsigned char, though, it will work,
> because of the integer promotions and usual arithmetic conversions).
> It suffices to replace ' ' with 0x20U.
Yes. I woke up this morning thinking on it. That the line should have been
  if ((unsigned char)header_line[i] < 32) {

I wouldn't have thought on using 0x20U instead of 32, but it seems that
it would work, too.

> Other than that, I am a little uncertain about the impact of this
> strictness could have on current applications, even if if correct.
In my humble opinion, there won't be applications using header
continuation. PHP could even define that header() would only
accept a single header with no line continuation with very little impact.