Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:75196
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.192.53 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <20140703003646.GA12662@openwall.com>
References: <20140703003646.GA12662@openwall.com>
Date: Thu, 3 Jul 2014 08:33:24 +0200
Message-ID: <CAEZPtU4+opJ42XBPhPJqZmBbf5d93sjK7VJUUo_e=Vpwnbg6XQ@mail.gmail.com>
To: Solar Designer <solar@openwall.com>
Cc: D0znpp <d0znpp@onsec.ru>, PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a11c2d6009885a104fd442f34
Subject: Re: [PHP-DEV] multiline HTTP headers support in header()
From: pierre.php@gmail.com (Pierre Joye)

--001a11c2d6009885a104fd442f34
Content-Type: text/plain; charset=UTF-8

On Jul 3, 2014 2:37 AM, "Solar Designer" <solar@openwall.com> wrote:
>
> Hi,
>
> Please drop multiline HTTP headers support from PHP header() because it
> was never needed in that layer, it is a security risk in combination
> with a certain IE bug, IE didn't support such multiline response headers
> properly anyway, and they are deprecated by RFC 7230:
>
> https://twitter.com/d0znpp/status/483147480843186176
> http://lab.onsec.ru/2012/08/php-multiple-headers-bypass-available.html
> http://tools.ietf.org/html/rfc7230#section-3.2.4
>
> I brought this to Pierre Joye's attention on Twitter today, and he
> agrees that "yes it should be removed" and asked me to "drop a mail to
> internals".  So I just did.

I confirm and reiterate my +1 here

Thanks for bringing this topic back to internals.

Cheers,
Pierre

--001a11c2d6009885a104fd442f34--