Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:75190
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.216.46 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAH-PCH5EbCz+80SyH1M8zqBR4WVqW4K_deDYbheZ5pkU1ch6HA@mail.gmail.com>
References: <20140703003646.GA12662@openwall.com>
	<53B4AC6E.5050401@sugarcrm.com>
	<F494C86C-44E9-4BBC-889F-ADEA38107612@ajf.me>
	<20140703012402.GA13015@openwall.com>
	<CADajX4CvRPVZ7P2UrEynXUJCSD2GCnMhP8zvy7+W29bnecTGGw@mail.gmail.com>
	<CAH-PCH5EbCz+80SyH1M8zqBR4WVqW4K_deDYbheZ5pkU1ch6HA@mail.gmail.com>
Date: Thu, 3 Jul 2014 07:42:14 +0200
Message-ID: <CAH-PCH6Pn1N5Xdsmj2xM16APYGUqU+nktFjwXTBfHN=ioFvqjA@mail.gmail.com>
To: Adam Harvey <aharvey@php.net>
Cc: Solar Designer <solar@openwall.com>, Andrea Faulds <ajf@ajf.me>, 
	Stas Malyshev <smalyshev@sugarcrm.com>, PHP internals <internals@lists.php.net>, 
	D0znpp <d0znpp@onsec.ru>
Content-Type: multipart/alternative; boundary=001a11c146e49533e904fd437865
Subject: Re: [PHP-DEV] multiline HTTP headers support in header()
From: tyra3l@gmail.com (Ferenc Kovacs)

--001a11c146e49533e904fd437865
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

On Thu, Jul 3, 2014 at 7:36 AM, Ferenc Kovacs <tyra3l@gmail.com> wrote:

>
>
>
> On Thu, Jul 3, 2014 at 3:29 AM, Adam Harvey <aharvey@php.net> wrote:
>
>> On 2 July 2014 18:24, Solar Designer <solar@openwall.com> wrote:
>> > On Thu, Jul 03, 2014 at 02:09:05AM +0100, Andrea Faulds wrote:
>> >> On 3 Jul 2014, at 02:05, Stas Malyshev <smalyshev@sugarcrm.com> wrote=
:
>> >> > So IE violates the RFC by misparsing the multiline headers? I'd say
>> it's
>> >> > an one more reason to never use IE :) RFC 7230 indeed proposes to
>> remove
>> >> > this capability, but it's not accepted yet, as far as I can see. We
>> can
>> >> > probably drop this immediately for 5.6, for previous versions I'm n=
ot
>> >> > sure if anybody uses this feature. So if anybody knows any use of i=
t,
>> >> > please tell, otherwise it's probably a good idea to kill it for
>> stable
>> >> > versions too.
>> >>
>> >> As I?ve had to implement HTTP myself for a particular non-PHP
>> application, I?ve read the original HTTP/1.1 RFC. As far as I know,
>> multi-line headers are semantically equivalent to single-line headers, s=
o
>> couldn?t we just ?flatten? them automatically? It shouldn?t break anythi=
ng
>> unless you?re deliberately misusing header().
>> >
>> > I think we could, and your analysis looks correct to me, but I see no
>> > good enough reason to go for the extra complexity.  Having a function
>> > defined in a more complicated manner and implemented with more code is
>> > asking for more bugs and mis-interactions.
>>
>> I'd tend to agree: if we're going to do this, let's just rip the
>> band-aid off completely. I've got a quick and dirty patch at
>>
>> https://github.com/LawnGnome/php-src/compare/remove-multiline-headers?ex=
pand=3D1
>> that does this, and applies cleanly against every branch from 5.4 to
>> master.
>>
>> I'm not so sure about the versions this should be applied too, though:
>> my current inclination is to only apply it to master and maybe 5.6 if
>> the RMs agreed. While it's a very, very small BC break (and hence one
>> I'm OK with in a minor branch like 5.6), I don't think we should do
>> this in a 5.4 or 5.5 point release =E2=80=94 recent history (the unseria=
lize()
>> hack) suggests that it's a nightmare to document and explain those
>> sorts of breaks.
>>
>> Adam
>>
>> --
>> PHP Internals - PHP Runtime Development Mailing List
>> To unsubscribe, visit: http://www.php.net/unsub.php
>>
>>
> If I'm reading this correctly this would reintroduce
> https://bugs.php.net/bug.php?id=3D60227
> those checks aren't there to support header splitting but to prevent them=
,
> as "\r\n" isn't the only separator which will cause browsers to split the
> header.
>
>
> --
> Ferenc Kov=C3=A1cs
> @Tyr43l - http://tyrael.hu
>

and for the record, my irc history tells me that Nikita sent an email about
http://lab.onsec.ru/2012/08/php-multiple-headers-bypass-available.html to
security@php.net back in 2012-08-24, so maybe there were some discussion
there which I'm missing.

--=20
Ferenc Kov=C3=A1cs
@Tyr43l - http://tyrael.hu

--001a11c146e49533e904fd437865--