Update header handling to RFC 7230

diff --git a/NEWS b/NEWS
index 2e45ad877ce93694dce7db5e8c1128c09ec9bd05..462d6a1733ac8d28f6c76d10fa610ede65a36333 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -3,6 +3,8 @@ PHP                                                                        NEWS
 ?? ??? 20?? PHP 5.4.38
 
 - Core:
+  . Removed support for multi-line headers, as the are deprecated by RFC 7230.
+    (Stas)
   . Fixed bug #68925 (Mitigation for CVE-2015-0235 – GHOST: glibc gethostbyname
     buffer overflow). (Stas)
 

diff --git a/ext/standard/tests/general_functions/bug60227_2.phpt b/ext/standard/tests/general_functions/bug60227_2.phpt
index 995c364eea23fa5ea5960ea1d19a2403b23eb819..2cdde78a4a9140d98acf0e5683aaaaaf6213e063 100644 (file)
--- a/ext/standard/tests/general_functions/bug60227_2.phpt
+++ b/ext/standard/tests/general_functions/bug60227_2.phpt
@@ -1,14 +1,15 @@
 --TEST--
 Bug #60227 (header() cannot detect the multi-line header with CR), \r before \n
+--INI--
+expose_php=0
 --FILE--
 <?php
 header("X-foo: e\n foo");
-header("X-Foo6: e\rSet-Cookie: ID=123\n d");
 echo 'foo';
 ?>
 --EXPECTF--
+
 Warning: Header may not contain more than a single header, new line detected in %s on line %d
 foo
 --EXPECTHEADERS--
-X-foo: e
-foo
+Content-type: text/html; charset=UTF-8

diff --git a/ext/standard/tests/general_functions/bug60227_3.phpt b/ext/standard/tests/general_functions/bug60227_3.phpt
index 8cba9b8aec67eba90a6e3aabfa2002cd107ce580..8246f1743835c307beb889604bc1f3ba76d0fb4a 100644 (file)
--- a/ext/standard/tests/general_functions/bug60227_3.phpt
+++ b/ext/standard/tests/general_functions/bug60227_3.phpt
@@ -1,8 +1,9 @@
 --TEST--
 Bug #60227 (header() cannot detect the multi-line header with CR), \0 before \n
+--INI--
+expose_php=0
 --FILE--
 <?php
-header("X-foo: e\n foo");
 header("X-Foo6: e\0Set-Cookie: ID=\n123\n d");
 echo 'foo';
 ?>
@@ -10,5 +11,4 @@ echo 'foo';
 Warning: Header may not contain NUL bytes in %s on line %d
 foo
 --EXPECTHEADERS--
-X-foo: e
-foo
+Content-type: text/html; charset=UTF-8

diff --git a/ext/standard/tests/general_functions/bug60227_4.phpt b/ext/standard/tests/general_functions/bug60227_4.phpt
index d5e2573d89cdc1420553dc7de89806f3f0ae85e0..20dba1a26568e55ad47a0af4e91efe9f59a417ba 100644 (file)
--- a/ext/standard/tests/general_functions/bug60227_4.phpt
+++ b/ext/standard/tests/general_functions/bug60227_4.phpt
@@ -1,8 +1,9 @@
 --TEST--
 Bug #60227 (header() cannot detect the multi-line header with CR), CRLF
+--INI--
+expose_php=0
 --FILE--
 <?php
-header("X-foo: e\r\n foo");
 header("X-foo: e\r\nfoo");
 echo 'foo';
 ?>
@@ -10,5 +11,4 @@ echo 'foo';
 Warning: Header may not contain more than a single header, new line detected in %s on line %d
 foo
 --EXPECTHEADERS--
-X-foo: e
- foo
+Content-type: text/html; charset=UTF-8

diff --git a/main/SAPI.c b/main/SAPI.c
index 994aff38bf7269d256b2f4c215a3e19efdd74f4f..1390d29f8c50736b0e4055e3800d0be1a6ef51df 100644 (file)
--- a/main/SAPI.c
+++ b/main/SAPI.c
@@ -743,13 +743,8 @@ SAPI_API int sapi_header_op(sapi_header_op_enum op, void *arg TSRMLS_DC)
                /* new line/NUL character safety check */
                int i;
                for (i = 0; i < header_line_len; i++) {
-                       /* RFC 2616 allows new lines if followed by SP or HT */
-                       int illegal_break =
-                                       (header_line[i+1] != ' ' && header_line[i+1] != '\t')
-                                       && (
-                                               header_line[i] == '\n'
-                                               || (header_line[i] == '\r' && header_line[i+1] != '\n'));
-                       if (illegal_break) {
+                       /* RFC 7230 ch. 3.2.4 deprecates folding support */
+                       if (header_line[i] == '\n' || header_line[i] == '\r') {
                                efree(header_line);
                                sapi_module.sapi_error(E_WARNING, "Header may not contain "
                                                "more than a single header, new line detected");