Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:75194
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.192.49 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <20140703060837.GB16494@openwall.com>
References: <20140703003646.GA12662@openwall.com>
	<53B4AC6E.5050401@sugarcrm.com>
	<F494C86C-44E9-4BBC-889F-ADEA38107612@ajf.me>
	<20140703012402.GA13015@openwall.com>
	<CADajX4CvRPVZ7P2UrEynXUJCSD2GCnMhP8zvy7+W29bnecTGGw@mail.gmail.com>
	<CAH-PCH5EbCz+80SyH1M8zqBR4WVqW4K_deDYbheZ5pkU1ch6HA@mail.gmail.com>
	<20140703060837.GB16494@openwall.com>
Date: Thu, 3 Jul 2014 08:14:51 +0200
Message-ID: <CAH-PCH6D-oZs0L5=oS5Akqajg+FiJYGN5B-Ymb0P4SnpSbR1LA@mail.gmail.com>
To: Solar Designer <solar@openwall.com>
Cc: Adam Harvey <aharvey@php.net>, Andrea Faulds <ajf@ajf.me>, Stas Malyshev <smalyshev@sugarcrm.com>, 
	PHP internals <internals@lists.php.net>, D0znpp <d0znpp@onsec.ru>
Content-Type: multipart/alternative; boundary=001a11c2c4523b992004fd43eda3
Subject: Re: [PHP-DEV] multiline HTTP headers support in header()
From: tyra3l@gmail.com (Ferenc Kovacs)

--001a11c2c4523b992004fd43eda3
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

On Thu, Jul 3, 2014 at 8:08 AM, Solar Designer <solar@openwall.com> wrote:

> On Thu, Jul 03, 2014 at 07:36:26AM +0200, Ferenc Kovacs wrote:
> > If I'm reading this correctly this would reintroduce
> > https://bugs.php.net/bug.php?id=3D60227
>
> No.
>
> > those checks aren't there to support header splitting but to prevent
> them,
> > as "\r\n" isn't the only separator which will cause browsers to split t=
he
> > header.
>
> Individual '\r' or '\n' may also separate headers in specific browsers,
> yes.  We should continue to disallow them as well.
>
> Adam's patch looks correct to me in this respect: strpbrk() returns
> non-NULL when _any_ of the characters is found.
>

my bad, I blame morning.

--=20
Ferenc Kov=C3=A1cs
@Tyr43l - http://tyrael.hu

--001a11c2c4523b992004fd43eda3--