Re: [PHP-DEV] Disallow newlines in CURLOPT_HTTPHEADER

Hi

On 2026-07-09 10:17, Sjoerd Langkemper wrote:
> Currently, it is possible to have multiple lines in a HTTP headers in a 
> cURL request, which then get interpreted as multiple headers:
> 
> […]
> 
> This is not supported behavior by cURL, and it is a security risk when 
> a header value is under control of an attacker: they can inject 
> arbitrary headers to the request.
> 
> I propose to not allow newlines in header values. Any thoughts on this? 
> Should this first raise a deprecation warning before throwing a value 
> error? I haven't added this to the deprecation RFC as I thought that is 
> being finalized and made ready for voting soon.

Ugh. I agree that this is unexpected behavior that enables security 
issues and would suggest going straight to ValueError with PHP 8.6. 
Since CURLOPT_HTTPHEADER already rejects string inputs:

     curl_setopt($ch, CURLOPT_HTTPHEADER, "Hello: world\r\nFoo: bar");

the API already very heavily implies that you are expected to pass 
headers as individual array elements - and it's also documented that 
way. Thus I would say this falls under the rules in 
https://wiki.php.net/rfc/policy-exempt-type-value-error-bc-policy.

Can you send a PR?

Best regards
Tim Düsterhus