Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:95826 Return-Path: Mailing-List: contact internals-help@lists.php.net; run by ezmlm Delivered-To: mailing list internals@lists.php.net Received: (qmail 83571 invoked from network); 9 Sep 2016 08:23:06 -0000 Received: from unknown (HELO lists.php.net) (127.0.0.1) by localhost with SMTP; 9 Sep 2016 08:23:06 -0000 Authentication-Results: pb1.pair.com smtp.mail=yohgaki@ohgaki.net; spf=pass; sender-id=pass Authentication-Results: pb1.pair.com header.from=yohgaki@ohgaki.net; sender-id=pass Received-SPF: pass (pb1.pair.com: domain ohgaki.net designates 180.42.98.130 as permitted sender) X-PHP-List-Original-Sender: yohgaki@ohgaki.net X-Host-Fingerprint: 180.42.98.130 ns1.es-i.jp Received: from [180.42.98.130] ([180.42.98.130:60154] helo=es-i.jp) by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP id D3/BC-61313-86172D75 for ; Fri, 09 Sep 2016 04:23:05 -0400 Received: (qmail 96746 invoked by uid 89); 9 Sep 2016 08:23:00 -0000 Received: from unknown (HELO mail-qk0-f173.google.com) (yohgaki@ohgaki.net@209.85.220.173) by 0 with ESMTPA; 9 Sep 2016 08:23:00 -0000 Received: by mail-qk0-f173.google.com with SMTP id z190so59329978qkc.3 for ; Fri, 09 Sep 2016 01:23:00 -0700 (PDT) X-Gm-Message-State: AE9vXwMDOu7LGi5gpWSjBi/65PoL2DLXeQpwxkhDwORFWfFu8H1ONrjyg+3EGYuWlCxx+jPps++WsJ0ciDftYg== X-Received: by 10.55.166.81 with SMTP id p78mr2329641qke.18.1473409374970; Fri, 09 Sep 2016 01:22:54 -0700 (PDT) MIME-Version: 1.0 Received: by 10.140.84.168 with HTTP; Fri, 9 Sep 2016 01:22:14 -0700 (PDT) In-Reply-To: References: Date: Fri, 9 Sep 2016 17:22:14 +0900 X-Gmail-Original-Message-ID: Message-ID: To: "internals@lists.php.net" Content-Type: text/plain; charset=UTF-8 Subject: Re: Disabling mail header injections via extra(additional) headers. From: yohgaki@ohgaki.net (Yasuo Ohgaki) Hi all, On Mon, Aug 8, 2016 at 8:33 AM, Yasuo Ohgaki wrote: > disabled \r\n injections, that could override hole contents of mail, > by checking string extra headers for mail/mb_send_mail already. > > Extra mail headers could be checked more by having array extra headers. > > https://bugs.php.net/bug.php?id=69791 > https://github.com/php/php-src/pull/2060 > > This patch accepts both "string"(current) and "array"(new) extra > headers. It does a lot more checks than string version. > > I spend only few hours including research for this, so it might > contain mistakes. > Please review. I'll merge this to master within a week or so. > > Thank you. > > P.S. Even with array extra headers, it cannot prevent unwanted mail > header injections. e.g. Attackers may inject unwanted 'bcc' headers > with bad code. However, it does better job than string only extra > headers. I'm confident the feature now. I'll merge the PR to master https://github.com/php/php-src/pull/2060 in a few days. If anyone feel there should be RFC, please let me know. Regards, -- Yasuo Ohgaki yohgaki@ohgaki.net