archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-17 14:38:49 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

MFH: Headers: forbid \r and \n also after \0, allow CRLF followed by HT or SP and forbid \0. See bug #60227.

Browse source
This commit is contained in:
Stanislav Malyshev 2012-03-07 07:49:56 +00:00
parent 5e80c05deb
commit 4cc747677c
5 changed files with 62 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

2
ext/standard/tests/general_functions/bug60227.phpt → ext/standard/tests/general_functions/bug60227_1.phpt
View file

@ -10,7 +10,7 @@ header("X-Foo5: e\rSet-Cookie: ID=123");
echo 'foo'; echo 'foo';
?> ?>
--EXPECTF-- --EXPECTF--
Warning: Header may not contain more than a single header, new line detected. in %s on line %d Warning: Header may not contain more than a single header, new line detected in %s on line %d
foo foo
--EXPECTHEADERS-- --EXPECTHEADERS--
X-Foo1: a X-Foo1: a

14
ext/standard/tests/general_functions/bug60227_2.phpt Normal file
View file

@ -0,0 +1,14 @@
--TEST--
Bug #60227 (header() cannot detect the multi-line header with CR), \r before \n
--FILE--
<?php
header("X-foo: e\n foo");
header("X-Foo6: e\rSet-Cookie: ID=123\n d");
echo 'foo';
?>
--EXPECTF--
Warning: Header may not contain more than a single header, new line detected in %s on line %d
foo
--EXPECTHEADERS--
X-foo: e
foo

14
ext/standard/tests/general_functions/bug60227_3.phpt Normal file
View file

@ -0,0 +1,14 @@
--TEST--
Bug #60227 (header() cannot detect the multi-line header with CR), \0 before \n
--FILE--
<?php
header("X-foo: e\n foo");
header("X-Foo6: e\0Set-Cookie: ID=\n123\n d");
echo 'foo';
?>
--EXPECTF--
Warning: Header may not contain NUL bytes in %s on line %d
foo
--EXPECTHEADERS--
X-foo: e
foo

14
ext/standard/tests/general_functions/bug60227_4.phpt Normal file
View file

@ -0,0 +1,14 @@
--TEST--
Bug #60227 (header() cannot detect the multi-line header with CR), CRLF
--FILE--
<?php
header("X-foo: e\r\n foo");
header("X-foo: e\r\nfoo");
echo 'foo';
?>
--EXPECTF--
Warning: Header may not contain more than a single header, new line detected in %s on line %d
foo
--EXPECTHEADERS--
X-foo: e
foo

28
main/SAPI.c
View file

@ -707,16 +707,26 @@ SAPI_API int sapi_header_op(sapi_header_op_enum op, void *arg TSRMLS_DC)
efree(header_line); efree(header_line);
return SUCCESS; return SUCCESS;
} else { } else {
/* new line safety check */ /* new line/NUL character safety check */
char *s = header_line, *e = header_line + header_line_len, *p; int i;
while (s < e && ((p = memchr(s, '\n', (e - s))) || (p = memchr(s, '\r', (e - s))))) { for (i = 0; i < header_line_len; i++) {
if (*(p + 1) == ' ' || *(p + 1) == '\t') { /* RFC 2616 allows new lines if followed by SP or HT */
s = p + 1; int illegal_break =
continue; (header_line[i+1] != ' ' && header_line[i+1] != '\t')
&& (
header_line[i] == '\n'
|| (header_line[i] == '\r' && header_line[i+1] != '\n'));
if (illegal_break) {
efree(header_line);
sapi_module.sapi_error(E_WARNING, "Header may not contain "
"more than a single header, new line detected");
return FAILURE;
}
if (header_line[i] == '\0') {
efree(header_line);
sapi_module.sapi_error(E_WARNING, "Header may not contain NUL bytes");
return FAILURE;
} }
efree(header_line);
sapi_module.sapi_error(E_WARNING, "Header may not contain more than a single header, new line detected.");
return FAILURE;
} }
} }