Re: [PHP-DEV] Disallow newlines in CURLOPT_HTTPHEADER

Hi

On 2026-07-09 12:49, Matteo Beccati wrote:
> Il 09/07/2026 10:17, Sjoerd Langkemper ha scritto:
>> This is not supported behavior by cURL, and it is a security risk when 
>> a header value is under control of an attacker: they can inject 
>> arbitrary headers to the request.
>> 
>> I propose to not allow newlines in header values. Any thoughts on 
>> this? Should this first raise a deprecation warning before throwing a 
>> value error? I haven't added this to the deprecation RFC as I thought 
>> that is being finalized and made ready for voting soon.
> 
> "\r\n" inside headers used to be perfectly legal for multiline headers.

This is not correct. What was legal was the sequence "\r\n" followed *by 
either a space or a tab*. And it is equivalent to just a space. The 
newlines are not “visible” in the parsed value. There is literally zero 
reason to emit the obsolete line-folding syntax nowadays. As far as I 
can tell it only existed due to considerations regarding the length of a 
single line.

> It is now obsolete, but I'm not sure why we should prevent it, if curl 
> does not.

Curl specifically documents:

> The headers included in the linked list must not be CRLF-terminated, 
> since libcurl adds CRLF after each header item itself. Failure to 
> comply with this might result in strange behavior. libcurl passes on 
> the verbatim strings you give it, without any filter or other safe 
> guards. That includes white space and control characters.

Best regards
Tim Düsterhus