mirror of
https://github.com/php/php-src.git
synced 2024-09-21 18:07:23 +00:00
MFH: Headers: forbid \r and \n also after \0, allow CRLF followed by HT or SP and forbid \0. See bug #60227.
This commit is contained in:
parent
5e80c05deb
commit
4cc747677c
@ -10,7 +10,7 @@ header("X-Foo5: e\rSet-Cookie: ID=123");
|
||||
echo 'foo';
|
||||
?>
|
||||
--EXPECTF--
|
||||
Warning: Header may not contain more than a single header, new line detected. in %s on line %d
|
||||
Warning: Header may not contain more than a single header, new line detected in %s on line %d
|
||||
foo
|
||||
--EXPECTHEADERS--
|
||||
X-Foo1: a
|
14
ext/standard/tests/general_functions/bug60227_2.phpt
Normal file
14
ext/standard/tests/general_functions/bug60227_2.phpt
Normal file
@ -0,0 +1,14 @@
|
||||
--TEST--
|
||||
Bug #60227 (header() cannot detect the multi-line header with CR), \r before \n
|
||||
--FILE--
|
||||
<?php
|
||||
header("X-foo: e\n foo");
|
||||
header("X-Foo6: e\rSet-Cookie: ID=123\n d");
|
||||
echo 'foo';
|
||||
?>
|
||||
--EXPECTF--
|
||||
Warning: Header may not contain more than a single header, new line detected in %s on line %d
|
||||
foo
|
||||
--EXPECTHEADERS--
|
||||
X-foo: e
|
||||
foo
|
14
ext/standard/tests/general_functions/bug60227_3.phpt
Normal file
14
ext/standard/tests/general_functions/bug60227_3.phpt
Normal file
@ -0,0 +1,14 @@
|
||||
--TEST--
|
||||
Bug #60227 (header() cannot detect the multi-line header with CR), \0 before \n
|
||||
--FILE--
|
||||
<?php
|
||||
header("X-foo: e\n foo");
|
||||
header("X-Foo6: e\0Set-Cookie: ID=\n123\n d");
|
||||
echo 'foo';
|
||||
?>
|
||||
--EXPECTF--
|
||||
Warning: Header may not contain NUL bytes in %s on line %d
|
||||
foo
|
||||
--EXPECTHEADERS--
|
||||
X-foo: e
|
||||
foo
|
14
ext/standard/tests/general_functions/bug60227_4.phpt
Normal file
14
ext/standard/tests/general_functions/bug60227_4.phpt
Normal file
@ -0,0 +1,14 @@
|
||||
--TEST--
|
||||
Bug #60227 (header() cannot detect the multi-line header with CR), CRLF
|
||||
--FILE--
|
||||
<?php
|
||||
header("X-foo: e\r\n foo");
|
||||
header("X-foo: e\r\nfoo");
|
||||
echo 'foo';
|
||||
?>
|
||||
--EXPECTF--
|
||||
Warning: Header may not contain more than a single header, new line detected in %s on line %d
|
||||
foo
|
||||
--EXPECTHEADERS--
|
||||
X-foo: e
|
||||
foo
|
28
main/SAPI.c
28
main/SAPI.c
@ -707,16 +707,26 @@ SAPI_API int sapi_header_op(sapi_header_op_enum op, void *arg TSRMLS_DC)
|
||||
efree(header_line);
|
||||
return SUCCESS;
|
||||
} else {
|
||||
/* new line safety check */
|
||||
char *s = header_line, *e = header_line + header_line_len, *p;
|
||||
while (s < e && ((p = memchr(s, '\n', (e - s))) || (p = memchr(s, '\r', (e - s))))) {
|
||||
if (*(p + 1) == ' ' || *(p + 1) == '\t') {
|
||||
s = p + 1;
|
||||
continue;
|
||||
/* new line/NUL character safety check */
|
||||
int i;
|
||||
for (i = 0; i < header_line_len; i++) {
|
||||
/* RFC 2616 allows new lines if followed by SP or HT */
|
||||
int illegal_break =
|
||||
(header_line[i+1] != ' ' && header_line[i+1] != '\t')
|
||||
&& (
|
||||
header_line[i] == '\n'
|
||||
|| (header_line[i] == '\r' && header_line[i+1] != '\n'));
|
||||
if (illegal_break) {
|
||||
efree(header_line);
|
||||
sapi_module.sapi_error(E_WARNING, "Header may not contain "
|
||||
"more than a single header, new line detected");
|
||||
return FAILURE;
|
||||
}
|
||||
if (header_line[i] == '\0') {
|
||||
efree(header_line);
|
||||
sapi_module.sapi_error(E_WARNING, "Header may not contain NUL bytes");
|
||||
return FAILURE;
|
||||
}
|
||||
efree(header_line);
|
||||
sapi_module.sapi_error(E_WARNING, "Header may not contain more than a single header, new line detected.");
|
||||
return FAILURE;
|
||||
}
|
||||
}
|
||||
|
||||
|
Loading…
Reference in New Issue
Block a user