Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:75235
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain adamharvey.name designates 209.85.223.178 as permitted sender)
MIME-Version: 1.0
Sender: adam@adamharvey.name
In-Reply-To: <CAHMUw2HFCUuQ5jk0uffP+093WE9SrYCf+94q71LBLA7Moy08jg@mail.gmail.com>
References: <20140703003646.GA12662@openwall.com> <53B4AC6E.5050401@sugarcrm.com>
 <F494C86C-44E9-4BBC-889F-ADEA38107612@ajf.me> <20140703012402.GA13015@openwall.com>
 <CADajX4CvRPVZ7P2UrEynXUJCSD2GCnMhP8zvy7+W29bnecTGGw@mail.gmail.com>
 <CAH-PCH5EbCz+80SyH1M8zqBR4WVqW4K_deDYbheZ5pkU1ch6HA@mail.gmail.com>
 <20140703060837.GB16494@openwall.com> <CAH-PCH4YVzU9wrsmY3XNLy=j3MmXfhmc+q6z5kXxy-y4OzTk_A@mail.gmail.com>
 <20140703063713.GA16777@openwall.com> <CAHMUw2HCwEZxtN5UsA6VRMpot05m-ZnTQE8jWbYMFLsEZW9muQ@mail.gmail.com>
 <53B51347.30405@sugarcrm.com> <CAHMUw2HFCUuQ5jk0uffP+093WE9SrYCf+94q71LBLA7Moy08jg@mail.gmail.com>
Date: Thu, 3 Jul 2014 10:37:41 -0700
Message-ID: <CADajX4AKrbzzyxFgUSo8HvVY7u5rRw870n7=N2oZerReia=xmw@mail.gmail.com>
To: Tjerk Meesters <tjerk.meesters@gmail.com>
Cc: Stas Malyshev <smalyshev@sugarcrm.com>, Solar Designer <solar@openwall.com>, 
	Ferenc Kovacs <tyra3l@gmail.com>, PHP internals <internals@lists.php.net>, D0znpp <d0znpp@onsec.ru>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] multiline HTTP headers support in header()
From: aharvey@php.net (Adam Harvey)

On 3 July 2014 03:11, Tjerk Meesters <tjerk.meesters@gmail.com> wrote:
>
> On Thu, Jul 3, 2014 at 4:24 PM, Stas Malyshev <smalyshev@sugarcrm.com>
> wrote:
>>
>> Hi!
>>
>> > Or, check for NUL byte first and reject the whole thing if present; th=
en
>> > continue with `strpbrk()` :)
>>
>> To check for nul, you need to scan the whole string. If you're already
>> doing this, you don't need strpbrk anymore.
>
>
> Right, with that in mind we might as well keep the current loop and just
> break at those three "bad" characters :)

I've updated https://github.com/LawnGnome/php-src/compare/remove-multiline-=
headers?expand=3D1
to do just that. I also added a null byte test to the new
header_multiline.phpt test =E2=80=94 I don't see a case in the bug60227 tes=
ts
that I'm removing that isn't now covered (all the other tests there
were related to multiline support, which has now been removed, so
there's little point retaining those tests).

I'm still thinking master and possibly 5.6 only for this. Does anyone
else have any thoughts (particularly Ferenc and/or Julien on the 5.6
front)?

Adam