Re: [PHP-DEV] Disallow newlines in CURLOPT_HTTPHEADER
[email protected] ("Sjoerd Langkemper") Mon, 27 Jul 2026 11:21:10 +0200
| Newsgroups | php.internals |
|---|---|
| Message-ID | <[email protected]> |
--a47d163b65de1647c9252f50ac63a8b8b93c95e9 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hi Jorg, Matteo, I wrote earlier: > It seems to me that this is exactly a case where this policy applies: = https://wiki.php.net/rfc/policy-exempt-type-value-error-bc-policy and: > I asked Daniel Stenberg about whether newlines are allowed in headers,=20 > and he said: > =20 > > The documentation says in clear terms: > >=20 > > The headers included in the linked list must not be CRLF-terminat= ed > >=20 > > I believe libcurl might change its treatment of them in a future and=20 > > start > > returning error earlier when such octets are found. On Mon, Jul 13, 2026, at 15:27, Tim D=C3=BCsterhus wrote: > Though I'm also seeing https://github.com/curl/curl/pull/22309, which = I=20 > think concludes the question. Given that Daniel Stenberg has said that newlines are not permitted, and= is currently developing a pull request to reject them, does this change= your view on whether PHP should reject newlines in headers passed to cu= rl? Do you think I still need an RFC for this functionality? Regards, Sjoerd Langkemper --a47d163b65de1647c9252f50ac63a8b8b93c95e9 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable <!DOCTYPE html><html><head><title></title></head><body><div>Hi Jorg, Mat= teo,</div><div><br></div><div>I wrote earlier:</div><blockquote type=3D"= cite" id=3D"qt" style=3D""><div><div>It seems to me that this is exactly= a case where this policy applies: <a href=3D"https://wiki.php.net/rfc/p= olicy-exempt-type-value-error-bc-policy">https://wiki.php.net/rfc/policy= -exempt-type-value-error-bc-policy</a></div></div></blockquote><div><br>= </div><div>and:</div><blockquote type=3D"cite" id=3D"qt" style=3D""><div= ><div>I asked Daniel Stenberg about whether newlines are allowed in head= ers, </div><div>and he said:</div><div> </div></div><div>> = The documentation says in clear terms:</div><div>> </div><div>&g= t; The headers included in the linked list must not be= CRLF-terminated</div><div>> </div><div>> I believe libcurl m= ight change its treatment of them in a future and </div><div>> s= tart</div><div>> returning error earlier when such octets are found.<= /div></blockquote><div><br>On Mon, Jul 13, 2026, at 15:27, Tim D=C3=BCst= erhus wrote:</div><blockquote type=3D"cite" id=3D"qt" style=3D""><div>Th= ough I'm also seeing <a href=3D"https://github.com/curl/curl/pull/2= 2309">https://github.com/curl/curl/pull/22309</a>, which I </div><d= iv>think concludes the question.<br></div></blockquote><div><br></div><d= iv>Given that Daniel Stenberg has said that newlines are not permitted, = and is currently developing a pull request to reject them, does this cha= nge your view on whether PHP should reject newlines in headers passed to= curl? Do you think I still need an RFC for this functionality?</div><di= v><br></div><div>Regards,</div><div><br></div><div>Sjoerd Langkemper</di= v></body></html> --a47d163b65de1647c9252f50ac63a8b8b93c95e9--