Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:75187
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain adamharvey.name designates 209.85.223.175 as permitted sender)
MIME-Version: 1.0
Sender: adam@adamharvey.name
In-Reply-To: <20140703012402.GA13015@openwall.com>
References: <20140703003646.GA12662@openwall.com> <53B4AC6E.5050401@sugarcrm.com>
 <F494C86C-44E9-4BBC-889F-ADEA38107612@ajf.me> <20140703012402.GA13015@openwall.com>
Date: Wed, 2 Jul 2014 18:29:11 -0700
Message-ID: <CADajX4CvRPVZ7P2UrEynXUJCSD2GCnMhP8zvy7+W29bnecTGGw@mail.gmail.com>
To: Solar Designer <solar@openwall.com>
Cc: Andrea Faulds <ajf@ajf.me>, Stas Malyshev <smalyshev@sugarcrm.com>, 
	PHP internals <internals@lists.php.net>, D0znpp <d0znpp@onsec.ru>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] multiline HTTP headers support in header()
From: aharvey@php.net (Adam Harvey)

On 2 July 2014 18:24, Solar Designer <solar@openwall.com> wrote:
> On Thu, Jul 03, 2014 at 02:09:05AM +0100, Andrea Faulds wrote:
>> On 3 Jul 2014, at 02:05, Stas Malyshev <smalyshev@sugarcrm.com> wrote:
>> > So IE violates the RFC by misparsing the multiline headers? I'd say it=
's
>> > an one more reason to never use IE :) RFC 7230 indeed proposes to remo=
ve
>> > this capability, but it's not accepted yet, as far as I can see. We ca=
n
>> > probably drop this immediately for 5.6, for previous versions I'm not
>> > sure if anybody uses this feature. So if anybody knows any use of it,
>> > please tell, otherwise it's probably a good idea to kill it for stable
>> > versions too.
>>
>> As I?ve had to implement HTTP myself for a particular non-PHP applicatio=
n, I?ve read the original HTTP/1.1 RFC. As far as I know, multi-line header=
s are semantically equivalent to single-line headers, so couldn?t we just ?=
flatten? them automatically? It shouldn?t break anything unless you?re deli=
berately misusing header().
>
> I think we could, and your analysis looks correct to me, but I see no
> good enough reason to go for the extra complexity.  Having a function
> defined in a more complicated manner and implemented with more code is
> asking for more bugs and mis-interactions.

I'd tend to agree: if we're going to do this, let's just rip the
band-aid off completely. I've got a quick and dirty patch at
https://github.com/LawnGnome/php-src/compare/remove-multiline-headers?expan=
d=3D1
that does this, and applies cleanly against every branch from 5.4 to
master.

I'm not so sure about the versions this should be applied too, though:
my current inclination is to only apply it to master and maybe 5.6 if
the RMs agreed. While it's a very, very small BC break (and hence one
I'm OK with in a minor branch like 5.6), I don't think we should do
this in a 5.4 or 5.5 point release =E2=80=94 recent history (the unserializ=
e()
hack) suggests that it's a nightmare to document and explain those
sorts of breaks.

Adam