Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:81798 Return-Path: Mailing-List: contact internals-help@lists.php.net; run by ezmlm Delivered-To: mailing list internals@lists.php.net Received: (qmail 82549 invoked from network); 4 Feb 2015 09:45:17 -0000 Received: from unknown (HELO lists.php.net) (127.0.0.1) by localhost with SMTP; 4 Feb 2015 09:45:17 -0000 Authentication-Results: pb1.pair.com header.from=nikita.ppv@gmail.com; sender-id=pass Authentication-Results: pb1.pair.com smtp.mail=nikita.ppv@gmail.com; spf=pass; sender-id=pass Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.212.181 as permitted sender) X-PHP-List-Original-Sender: nikita.ppv@gmail.com X-Host-Fingerprint: 209.85.212.181 mail-wi0-f181.google.com Received: from [209.85.212.181] ([209.85.212.181:57089] helo=mail-wi0-f181.google.com) by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP id 14/E5-55046-B2AE1D45 for ; Wed, 04 Feb 2015 04:45:16 -0500 Received: by mail-wi0-f181.google.com with SMTP id fb4so2289191wid.2 for ; Wed, 04 Feb 2015 01:45:12 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=B1U4uZtV7y/bX0RS/N/mswsbfUIoymSS3BXiur99IB0=; b=QRji80HONwtmDj1GmLxWrywXr7tfxHhAGVkYTni1rVMqgu4OUirxDkXXb9cumLnuG7 fVcrE2Sv7ZZGWqMVurU/J3SEuM1R5/T9ai4BwMAgQG5gFSALsH3HsMyD6lk4ONWKsqOz x9NYx2fiTY0B0GmiL8+qdwbus5VdMyZUaH240I89JCPXZT/JSFcHP/m98f+FyDfSMlx6 m5Ipi1B5VfbG+m3FlgM/Ic/qQvpojAs6evFCZwLUJg8RfFRf4SluQ+BDAQamqehAxJ/E LeGl26X1RHOepcD1rnOWanUoWF+tlEY9ChZ0bWsXng6hXYHabuircsv3+aNfUZ8MnjPY BmvQ== MIME-Version: 1.0 X-Received: by 10.180.75.80 with SMTP id a16mr25237080wiw.3.1423043111867; Wed, 04 Feb 2015 01:45:11 -0800 (PST) Received: by 10.27.10.138 with HTTP; Wed, 4 Feb 2015 01:45:11 -0800 (PST) In-Reply-To: <54D1C946.5080804@gmail.com> References: <54D1C946.5080804@gmail.com> Date: Wed, 4 Feb 2015 10:45:11 +0100 Message-ID: To: Stanislav Malyshev Cc: PHP Internals Content-Type: multipart/alternative; boundary=f46d043894f92edafc050e400b40 Subject: Re: [PHP-DEV] removing http line folding support? From: nikita.ppv@gmail.com (Nikita Popov) --f46d043894f92edafc050e400b40 Content-Type: text/plain; charset=UTF-8 On Wed, Feb 4, 2015 at 8:24 AM, Stanislav Malyshev wrote: > Hi! > > Our header() function supports multiline HTTP headers, which are allowed > by RFC 2616. However, newer RFC - > https://tools.ietf.org/html/rfc7230#section-3.2.4 - deprecates them and > says: > > Historically, HTTP header field values could be extended over > multiple lines by preceding each extra line with at least one space > or horizontal tab (obs-fold). This specification deprecates such > line folding except within the message/http media type > (Section 8.3.1). A sender MUST NOT generate a message that includes > line folding (i.e., that has any field-value that contains a match to > the obs-fold rule) unless the message is intended for packaging > within the message/http media type. > > So, my question is - any objections for dropping this functionality? I'd > be inclined to drop it in all versions from 5.4 up since it may still be > confusing some not too smart clients that don't implement full spec, and > frankly to me it doesn't seem of any use anyhow, but if you disagree, > please explain. > I'm +1 on dropping this. IIRC IE does not (or at least did not) support this as well, so our header injection protection is broken for users of IE. Nikita --f46d043894f92edafc050e400b40--