Re: [PHP-DEV] Disallow newlines in CURLOPT_HTTPHEADER

Hi,

Il 09/07/2026 10:17, Sjoerd Langkemper ha scritto:
> This is not supported behavior by cURL, and it is a security risk when a 
> header value is under control of an attacker: they can inject arbitrary 
> headers to the request.
> 
> I propose to not allow newlines in header values. Any thoughts on 
> this? Should this first raise a deprecation warning before throwing a 
> value error? I haven't added this to the deprecation RFC as I thought 
> that is being finalized and made ready for voting soon.

"\r\n" inside headers used to be perfectly legal for multiline headers.

It is now obsolete, but I'm not sure why we should prevent it, if curl 
does not.

See:
https://www.rfc-editor.org/info/rfc9112/#name-obsolete-line-folding


Cheers
-- 
Matteo Beccati