Re: libcurl(?) bug

On 09.02.2021 at 13:17, Tamas Papp wrote:

> I might found a bug, but I'm unsure and I'm unsure if it's libcurl or a
> php issue.
>
>
> There is this code (got from a dev, I am a sysadmin):
>
> <?php
>   ini_set('display_errors', 1);
>   error_reporting(E_ALL);
>
>   $ch = curl_init();
>   $url = 'https://google.com';
>   curl_setopt($ch, CURLOPT_URL, $url);
>   curl_setopt($ch, CURLOPT_HEADER, false);
>   curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
>   curl_setopt($ch, CURLOPT_DNS_CACHE_TIMEOUT, 0);
>   curl_setopt($ch, CURLOPT_TIMEOUT, 30);
>   curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
>   curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
>   // ORIGINAL:
>   //curl_setopt($ch, CURLOPT_HTTPHEADER, array("Accept: xml/, text/,
> /\r\n"));
>
>   // OK:
>   //curl_setopt($ch, CURLOPT_HTTPHEADER, array("Accept: /\r"));
>
>   // NOK:
>   curl_setopt($ch, CURLOPT_HTTPHEADER, array("Accept: /\r\n"));
>
>   $response = curl_exec($ch);
>   if(curl_exec($ch) === false) $response .= curl_error($ch);
>   curl_close($ch);
>
>   print_r($response);
> ?>
>
> There is an extra HTTP header is like this and it works:
>
>   curl_setopt($ch, CURLOPT_HTTPHEADER, array("Accept: /\r"));
>
>
> It does not work if it looks like this:
>
>   curl_setopt($ch, CURLOPT_HTTPHEADER, array("Accept: /\r*\n*"));
>
>
> Or it works if the $url is not *https*, but http.
>
>
> The original code worked on Debian 9 and Ubuntu 18.04 and does not work
> on Debian 10 and Ubuntu 20.04 and no matters if PHP comes from Sury's
> PPA or from the original distribution.
>
> That's why libcurl is suspicious to me.
>
>
> Do you have any thoughts on this?

I don't think that CURLOPT_HTTPHEADERs are supposed to have a trailing CRLF.

Christoph