Disallow newlines in CURLOPT_HTTPHEADER - #22651

Closed
Sjord wants to merge 4 commits into
php:masterfrom
Sjord:headers-without-newlines
Closed

Disallow newlines in CURLOPT_HTTPHEADER#22651
Sjord wants to merge 4 commits into
php:masterfrom
Sjord:headers-without-newlines

Conversation

@Sjord

@SjordSjord commented Jul 9, 2026

Copy link
Copy Markdown
Contributor

It was possible to have multiple lines in a HTTP headers in a cURL request, which then get interpreted as multiple headers. This commit changes that to throw a ValueError when using newlines or carriage returns in a string passed as header.

@Sjord
Disallow newlines in CURLOPT_HTTPHEADER
8020788
It was possible to have multiple lines in a HTTP headers in a cURL
request, which then get interpreted as multiple headers. This commit
changes that to throw a ValueError when using newlines or carriage
returns in a string passed as header.
@Sjord
Sjord requested a review from adoy as a code ownerJuly 9, 2026 09:38
@Sjord

Sjord commented Jul 9, 2026

Copy link
Copy Markdown
ContributorAuthor

Ping @TimWolla (https://news-web.php.net/php.internals/131828)

TimWolla
TimWolla reviewed Jul 9, 2026
View reviewed changes

@TimWollaTimWolla left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you!

Comment threadext/curl/interface.c Outdated
Comment threadext/curl/interface.c Outdated
Comment threadext/curl/interface.c Outdated
Sjord added 2 commits July 9, 2026 12:23
@Sjord
Change error message, use switch for readability
1846f78
Based on PR review comments. I'll do the NUL byte check separately.
@Sjord
Throw an error on NUL byte in arrays
21fb5b8
This is already done for string options in php_curl_option_str
(see bug #68089). Similarly, array arguments should also not contain NUL
bytes, so we throw the same error for these.
TimWolla
TimWolla reviewed Jul 9, 2026
View reviewed changes
Comment threadext/curl/interface.c Outdated
TimWolla
TimWolla approved these changes Jul 9, 2026
View reviewed changes

@TimWollaTimWolla left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, but there were some concerns raised on the mailing list.

Sjord added a commit to Sjord/php-src that referenced this pull request Jul 10, 2026
@Sjord
Throw an error on null byte in curl array options
32d6e08
This is already done for string options in php_curl_option_str
(see bug #68089). Similarly, array arguments should also not contain
null bytes, so we throw the same error for these.
This was extracted from php#22651, as
this seems less controversial.
Using null bytes is clearly not supported and curl just throws away
everything after the null byte, so
https://wiki.php.net/rfc/policy-exempt-type-value-error-bc-policy seems
to apply here.
@SjordSjord mentioned this pull request Jul 10, 2026
Merged
@Sjord

Sjord commented Jul 10, 2026

Copy link
Copy Markdown
ContributorAuthor

I extracted the null byte check to #22662. The newline check needs further discussion.

Girgias pushed a commit that referenced this pull request Jul 10, 2026
@Sjord
Throw an error on null byte in curl array options (#22662)
d1d144e
This is already done for string options in php_curl_option_str
(see bug #68089). Similarly, array arguments should also not contain
null bytes, so we throw the same error for these.
This was extracted from #22651, as
this seems less controversial.
Using null bytes is clearly not supported and curl just throws away
everything after the null byte, so
https://wiki.php.net/rfc/policy-exempt-type-value-error-bc-policy seems
to apply here.
@Sjord

Sjord commented Jul 27, 2026

Copy link
Copy Markdown
ContributorAuthor

@mbeccati still objects:

My point of view is that libcurl will eventually take care of it. No pressing need to do anything on our side.

As such, this needs an RFC. I am not feeling like pursuing this currently, so I'll close this for now.

@SjordSjord closed this Jul 27, 2026
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@TimWollaTimWollaTimWolla approved these changes
@adoyadoyAwaiting requested review from adoyadoy is a code owner

Assignees

No one assigned

Labels

Extension: curl

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@Sjord@TimWolla
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
Disallow newlines in CURLOPT_HTTPHEADER - #22651
Closed
Sjord wants to merge 4 commits into
php:masterfrom 
Sjord:headers-without-newlines
Closed
Disallow newlines in CURLOPT_HTTPHEADER#22651
Sjord wants to merge 4 commits into
php:masterfrom 
Sjord:headers-without-newlines
Conversation
@Sjord
@SjordSjord
commented
Jul 9, 2026

Copy link


Copy Markdown

Contributor
It was possible to have multiple lines in a HTTP headers in a cURL request, which then get interpreted as multiple headers. This commit changes that to throw a ValueError when using newlines or carriage returns in a string passed as header.
@Sjord
Disallow newlines in CURLOPT_HTTPHEADER
8020788
It was possible to have multiple lines in a HTTP headers in a cURL
request, which then get interpreted as multiple headers. This commit
changes that to throw a ValueError when using newlines or carriage
returns in a string passed as header.
@Sjord
Sjord
requested a review
from adoy
as a code ownerJuly 9, 2026 09:38
@Sjord
Sjord
commented
Jul 9, 2026

Copy link


Copy Markdown

ContributorAuthor
Ping @TimWolla (https://news-web.php.net/php.internals/131828)
TimWolla
TimWolla
reviewed
Jul 9, 2026
View reviewed changes
@TimWollaTimWolla
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you!
Comment threadext/curl/interface.c
Outdated

Comment threadext/curl/interface.c
Outdated

Comment threadext/curl/interface.c
Outdated

Sjord
added 2 commits
July 9, 2026 12:23
@Sjord
Change error message, use switch for readability
1846f78
Based on PR review comments. I'll do the NUL byte check separately.
@Sjord
Throw an error on NUL byte in arrays
21fb5b8
This is already done for string options in php_curl_option_str
(see bug #68089). Similarly, array arguments should also not contain NUL
bytes, so we throw the same error for these.
TimWolla
TimWolla
reviewed
Jul 9, 2026
View reviewed changes
Comment threadext/curl/interface.c
Outdated

TimWolla
TimWolla
approved these changes
Jul 9, 2026
View reviewed changes
@TimWollaTimWolla
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, but there were some concerns raised on the mailing list.
Sjord added a commit
to Sjord/php-src
that referenced
this pull request
Jul 10, 2026
@Sjord
Throw an error on null byte in curl array options
32d6e08
This is already done for string options in php_curl_option_str
(see bug #68089). Similarly, array arguments should also not contain
null bytes, so we throw the same error for these.
This was extracted from php#22651, as
this seems less controversial.
Using null bytes is clearly not supported and curl just throws away
everything after the null byte, so
https://wiki.php.net/rfc/policy-exempt-type-value-error-bc-policy seems
to apply here.
@SjordSjord
mentioned this pull request
Jul 10, 2026
 Merged

@Sjord
Sjord
commented
Jul 10, 2026

Copy link


Copy Markdown

ContributorAuthor
I extracted the null byte check to #22662. The newline check needs further discussion.
Girgias pushed a commit
that referenced
this pull request
Jul 10, 2026
@Sjord
Throw an error on null byte in curl array options (#22662)
d1d144e
This is already done for string options in php_curl_option_str
(see bug #68089). Similarly, array arguments should also not contain
null bytes, so we throw the same error for these.
This was extracted from #22651, as
this seems less controversial.
Using null bytes is clearly not supported and curl just throws away
everything after the null byte, so
https://wiki.php.net/rfc/policy-exempt-type-value-error-bc-policy seems
to apply here.
@Sjord
Sjord
commented
Jul 27, 2026

Copy link


Copy Markdown

ContributorAuthor
@mbeccati still objects:
My point of view is that libcurl will eventually take care of it. No pressing need to do anything on our side.
As such, this needs an RFC. I am not feeling like pursuing this currently, so I'll close this for now.
@SjordSjord
closed this
Jul 27, 2026
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@TimWollaTimWollaTimWolla approved these changes
@adoyadoyAwaiting requested review from adoyadoy is a code owner

Assignees


No one assigned


Labels

Extension: curl

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@Sjord@TimWolla

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Disallow newlines in CURLOPT_HTTPHEADER - #22651
Closed
Sjord wants to merge 4 commits into
php:masterfrom 
Sjord:headers-without-newlines
Closed
Disallow newlines in CURLOPT_HTTPHEADER#22651
Sjord wants to merge 4 commits into
php:masterfrom 
Sjord:headers-without-newlines
Conversation
@Sjord
@SjordSjord
commented
Jul 9, 2026

Copy link


Copy Markdown

Contributor
It was possible to have multiple lines in a HTTP headers in a cURL request, which then get interpreted as multiple headers. This commit changes that to throw a ValueError when using newlines or carriage returns in a string passed as header.
@Sjord
Disallow newlines in CURLOPT_HTTPHEADER
8020788
It was possible to have multiple lines in a HTTP headers in a cURL
request, which then get interpreted as multiple headers. This commit
changes that to throw a ValueError when using newlines or carriage
returns in a string passed as header.
@Sjord
Sjord
requested a review
from adoy
as a code ownerJuly 9, 2026 09:38
@Sjord
Sjord
commented
Jul 9, 2026

Copy link


Copy Markdown

ContributorAuthor
Ping @TimWolla (https://news-web.php.net/php.internals/131828)
TimWolla
TimWolla
reviewed
Jul 9, 2026
View reviewed changes
@TimWollaTimWolla
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you!
Comment threadext/curl/interface.c
Outdated

Comment threadext/curl/interface.c
Outdated

Comment threadext/curl/interface.c
Outdated

Sjord
added 2 commits
July 9, 2026 12:23
@Sjord
Change error message, use switch for readability
1846f78
Based on PR review comments. I'll do the NUL byte check separately.
@Sjord
Throw an error on NUL byte in arrays
21fb5b8
This is already done for string options in php_curl_option_str
(see bug #68089). Similarly, array arguments should also not contain NUL
bytes, so we throw the same error for these.
TimWolla
TimWolla
reviewed
Jul 9, 2026
View reviewed changes
Comment threadext/curl/interface.c
Outdated

TimWolla
TimWolla
approved these changes
Jul 9, 2026
View reviewed changes
@TimWollaTimWolla
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, but there were some concerns raised on the mailing list.
Sjord added a commit
to Sjord/php-src
that referenced
this pull request
Jul 10, 2026
@Sjord
Throw an error on null byte in curl array options
32d6e08
This is already done for string options in php_curl_option_str
(see bug #68089). Similarly, array arguments should also not contain
null bytes, so we throw the same error for these.
This was extracted from php#22651, as
this seems less controversial.
Using null bytes is clearly not supported and curl just throws away
everything after the null byte, so
https://wiki.php.net/rfc/policy-exempt-type-value-error-bc-policy seems
to apply here.
@SjordSjord
mentioned this pull request
Jul 10, 2026
 Merged

@Sjord
Sjord
commented
Jul 10, 2026

Copy link


Copy Markdown

ContributorAuthor
I extracted the null byte check to #22662. The newline check needs further discussion.
Girgias pushed a commit
that referenced
this pull request
Jul 10, 2026
@Sjord
Throw an error on null byte in curl array options (#22662)
d1d144e
This is already done for string options in php_curl_option_str
(see bug #68089). Similarly, array arguments should also not contain
null bytes, so we throw the same error for these.
This was extracted from #22651, as
this seems less controversial.
Using null bytes is clearly not supported and curl just throws away
everything after the null byte, so
https://wiki.php.net/rfc/policy-exempt-type-value-error-bc-policy seems
to apply here.
@Sjord
Sjord
commented
Jul 27, 2026

Copy link


Copy Markdown

ContributorAuthor
@mbeccati still objects:
My point of view is that libcurl will eventually take care of it. No pressing need to do anything on our side.
As such, this needs an RFC. I am not feeling like pursuing this currently, so I'll close this for now.
@SjordSjord
closed this
Jul 27, 2026
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@TimWollaTimWollaTimWolla approved these changes
@adoyadoyAwaiting requested review from adoyadoy is a code owner

Assignees


No one assigned


Labels

Extension: curl

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@Sjord@TimWolla

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Disallow newlines in CURLOPT_HTTPHEADER - #22651
Closed
Sjord wants to merge 4 commits into
php:masterfrom 
Sjord:headers-without-newlines
Closed
Disallow newlines in CURLOPT_HTTPHEADER#22651
Sjord wants to merge 4 commits into
php:masterfrom 
Sjord:headers-without-newlines
Conversation
@Sjord
@SjordSjord
commented
Jul 9, 2026

Copy link


Copy Markdown

Contributor
It was possible to have multiple lines in a HTTP headers in a cURL request, which then get interpreted as multiple headers. This commit changes that to throw a ValueError when using newlines or carriage returns in a string passed as header.
@Sjord
Disallow newlines in CURLOPT_HTTPHEADER
8020788
It was possible to have multiple lines in a HTTP headers in a cURL
request, which then get interpreted as multiple headers. This commit
changes that to throw a ValueError when using newlines or carriage
returns in a string passed as header.
@Sjord
Sjord
requested a review
from adoy
as a code ownerJuly 9, 2026 09:38
@Sjord
Sjord
commented
Jul 9, 2026

Copy link


Copy Markdown

ContributorAuthor
Ping @TimWolla (https://news-web.php.net/php.internals/131828)
TimWolla
TimWolla
reviewed
Jul 9, 2026
View reviewed changes
@TimWollaTimWolla
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you!
Comment threadext/curl/interface.c
Outdated

Comment threadext/curl/interface.c
Outdated

Comment threadext/curl/interface.c
Outdated

Sjord
added 2 commits
July 9, 2026 12:23
@Sjord
Change error message, use switch for readability
1846f78
Based on PR review comments. I'll do the NUL byte check separately.
@Sjord
Throw an error on NUL byte in arrays
21fb5b8
This is already done for string options in php_curl_option_str
(see bug #68089). Similarly, array arguments should also not contain NUL
bytes, so we throw the same error for these.
TimWolla
TimWolla
reviewed
Jul 9, 2026
View reviewed changes
Comment threadext/curl/interface.c
Outdated

TimWolla
TimWolla
approved these changes
Jul 9, 2026
View reviewed changes
@TimWollaTimWolla
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, but there were some concerns raised on the mailing list.
Sjord added a commit
to Sjord/php-src
that referenced
this pull request
Jul 10, 2026
@Sjord
Throw an error on null byte in curl array options
32d6e08
This is already done for string options in php_curl_option_str
(see bug #68089). Similarly, array arguments should also not contain
null bytes, so we throw the same error for these.
This was extracted from php#22651, as
this seems less controversial.
Using null bytes is clearly not supported and curl just throws away
everything after the null byte, so
https://wiki.php.net/rfc/policy-exempt-type-value-error-bc-policy seems
to apply here.
@SjordSjord
mentioned this pull request
Jul 10, 2026
 Merged

@Sjord
Sjord
commented
Jul 10, 2026

Copy link


Copy Markdown

ContributorAuthor
I extracted the null byte check to #22662. The newline check needs further discussion.
Girgias pushed a commit
that referenced
this pull request
Jul 10, 2026
@Sjord
Throw an error on null byte in curl array options (#22662)
d1d144e
This is already done for string options in php_curl_option_str
(see bug #68089). Similarly, array arguments should also not contain
null bytes, so we throw the same error for these.
This was extracted from #22651, as
this seems less controversial.
Using null bytes is clearly not supported and curl just throws away
everything after the null byte, so
https://wiki.php.net/rfc/policy-exempt-type-value-error-bc-policy seems
to apply here.
@Sjord
Sjord
commented
Jul 27, 2026

Copy link


Copy Markdown

ContributorAuthor
@mbeccati still objects:
My point of view is that libcurl will eventually take care of it. No pressing need to do anything on our side.
As such, this needs an RFC. I am not feeling like pursuing this currently, so I'll close this for now.
@SjordSjord
closed this
Jul 27, 2026
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@TimWollaTimWollaTimWolla approved these changes
@adoyadoyAwaiting requested review from adoyadoy is a code owner

Assignees


No one assigned


Labels

Extension: curl

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@Sjord@TimWolla

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
Disallow newlines in CURLOPT_HTTPHEADER - #22651
Closed
Sjord wants to merge 4 commits into
php:masterfrom 
Sjord:headers-without-newlines
Closed
Disallow newlines in CURLOPT_HTTPHEADER#22651
Sjord wants to merge 4 commits into
php:masterfrom 
Sjord:headers-without-newlines
Conversation
@Sjord
@SjordSjord
commented
Jul 9, 2026

Copy link


Copy Markdown

Contributor
It was possible to have multiple lines in a HTTP headers in a cURL request, which then get interpreted as multiple headers. This commit changes that to throw a ValueError when using newlines or carriage returns in a string passed as header.
@Sjord
Disallow newlines in CURLOPT_HTTPHEADER
8020788
It was possible to have multiple lines in a HTTP headers in a cURL
request, which then get interpreted as multiple headers. This commit
changes that to throw a ValueError when using newlines or carriage
returns in a string passed as header.
@Sjord
Sjord
requested a review
from adoy
as a code ownerJuly 9, 2026 09:38
@Sjord
Sjord
commented
Jul 9, 2026

Copy link


Copy Markdown

ContributorAuthor
Ping @TimWolla (https://news-web.php.net/php.internals/131828)
TimWolla
TimWolla
reviewed
Jul 9, 2026
View reviewed changes
@TimWollaTimWolla
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you!
Comment threadext/curl/interface.c
Outdated

Comment threadext/curl/interface.c
Outdated

Comment threadext/curl/interface.c
Outdated

Sjord
added 2 commits
July 9, 2026 12:23
@Sjord
Change error message, use switch for readability
1846f78
Based on PR review comments. I'll do the NUL byte check separately.
@Sjord
Throw an error on NUL byte in arrays
21fb5b8
This is already done for string options in php_curl_option_str
(see bug #68089). Similarly, array arguments should also not contain NUL
bytes, so we throw the same error for these.
TimWolla
TimWolla
reviewed
Jul 9, 2026
View reviewed changes
Comment threadext/curl/interface.c
Outdated

TimWolla
TimWolla
approved these changes
Jul 9, 2026
View reviewed changes
@TimWollaTimWolla
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, but there were some concerns raised on the mailing list.
Sjord added a commit
to Sjord/php-src
that referenced
this pull request
Jul 10, 2026
@Sjord
Throw an error on null byte in curl array options
32d6e08
This is already done for string options in php_curl_option_str
(see bug #68089). Similarly, array arguments should also not contain
null bytes, so we throw the same error for these.
This was extracted from php#22651, as
this seems less controversial.
Using null bytes is clearly not supported and curl just throws away
everything after the null byte, so
https://wiki.php.net/rfc/policy-exempt-type-value-error-bc-policy seems
to apply here.
@SjordSjord
mentioned this pull request
Jul 10, 2026
 Merged

@Sjord
Sjord
commented
Jul 10, 2026

Copy link


Copy Markdown

ContributorAuthor
I extracted the null byte check to #22662. The newline check needs further discussion.
Girgias pushed a commit
that referenced
this pull request
Jul 10, 2026
@Sjord
Throw an error on null byte in curl array options (#22662)
d1d144e
This is already done for string options in php_curl_option_str
(see bug #68089). Similarly, array arguments should also not contain
null bytes, so we throw the same error for these.
This was extracted from #22651, as
this seems less controversial.
Using null bytes is clearly not supported and curl just throws away
everything after the null byte, so
https://wiki.php.net/rfc/policy-exempt-type-value-error-bc-policy seems
to apply here.
@Sjord
Sjord
commented
Jul 27, 2026

Copy link


Copy Markdown

ContributorAuthor
@mbeccati still objects:
My point of view is that libcurl will eventually take care of it. No pressing need to do anything on our side.
As such, this needs an RFC. I am not feeling like pursuing this currently, so I'll close this for now.
@SjordSjord
closed this
Jul 27, 2026
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@TimWollaTimWollaTimWolla approved these changes
@adoyadoyAwaiting requested review from adoyadoy is a code owner

Assignees


No one assigned


Labels

Extension: curl

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@Sjord@TimWolla

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Disallow newlines in CURLOPT_HTTPHEADER - #22651
Closed
Sjord wants to merge 4 commits into
php:masterfrom 
Sjord:headers-without-newlines
Closed
Disallow newlines in CURLOPT_HTTPHEADER#22651
Sjord wants to merge 4 commits into
php:masterfrom 
Sjord:headers-without-newlines
Conversation
@Sjord
@SjordSjord
commented
Jul 9, 2026

Copy link


Copy Markdown

Contributor
It was possible to have multiple lines in a HTTP headers in a cURL request, which then get interpreted as multiple headers. This commit changes that to throw a ValueError when using newlines or carriage returns in a string passed as header.
@Sjord
Disallow newlines in CURLOPT_HTTPHEADER
8020788
It was possible to have multiple lines in a HTTP headers in a cURL
request, which then get interpreted as multiple headers. This commit
changes that to throw a ValueError when using newlines or carriage
returns in a string passed as header.
@Sjord
Sjord
requested a review
from adoy
as a code ownerJuly 9, 2026 09:38
@Sjord
Sjord
commented
Jul 9, 2026

Copy link


Copy Markdown

ContributorAuthor
Ping @TimWolla (https://news-web.php.net/php.internals/131828)
TimWolla
TimWolla
reviewed
Jul 9, 2026
View reviewed changes
@TimWollaTimWolla
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you!
Comment threadext/curl/interface.c
Outdated

Comment threadext/curl/interface.c
Outdated

Comment threadext/curl/interface.c
Outdated

Sjord
added 2 commits
July 9, 2026 12:23
@Sjord
Change error message, use switch for readability
1846f78
Based on PR review comments. I'll do the NUL byte check separately.
@Sjord
Throw an error on NUL byte in arrays
21fb5b8
This is already done for string options in php_curl_option_str
(see bug #68089). Similarly, array arguments should also not contain NUL
bytes, so we throw the same error for these.
TimWolla
TimWolla
reviewed
Jul 9, 2026
View reviewed changes
Comment threadext/curl/interface.c
Outdated

TimWolla
TimWolla
approved these changes
Jul 9, 2026
View reviewed changes
@TimWollaTimWolla
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, but there were some concerns raised on the mailing list.
Sjord added a commit
to Sjord/php-src
that referenced
this pull request
Jul 10, 2026
@Sjord
Throw an error on null byte in curl array options
32d6e08
This is already done for string options in php_curl_option_str
(see bug #68089). Similarly, array arguments should also not contain
null bytes, so we throw the same error for these.
This was extracted from php#22651, as
this seems less controversial.
Using null bytes is clearly not supported and curl just throws away
everything after the null byte, so
https://wiki.php.net/rfc/policy-exempt-type-value-error-bc-policy seems
to apply here.
@SjordSjord
mentioned this pull request
Jul 10, 2026
 Merged

@Sjord
Sjord
commented
Jul 10, 2026

Copy link


Copy Markdown

ContributorAuthor
I extracted the null byte check to #22662. The newline check needs further discussion.
Girgias pushed a commit
that referenced
this pull request
Jul 10, 2026
@Sjord
Throw an error on null byte in curl array options (#22662)
d1d144e
This is already done for string options in php_curl_option_str
(see bug #68089). Similarly, array arguments should also not contain
null bytes, so we throw the same error for these.
This was extracted from #22651, as
this seems less controversial.
Using null bytes is clearly not supported and curl just throws away
everything after the null byte, so
https://wiki.php.net/rfc/policy-exempt-type-value-error-bc-policy seems
to apply here.
@Sjord
Sjord
commented
Jul 27, 2026

Copy link


Copy Markdown

ContributorAuthor
@mbeccati still objects:
My point of view is that libcurl will eventually take care of it. No pressing need to do anything on our side.
As such, this needs an RFC. I am not feeling like pursuing this currently, so I'll close this for now.
@SjordSjord
closed this
Jul 27, 2026
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@TimWollaTimWollaTimWolla approved these changes
@adoyadoyAwaiting requested review from adoyadoy is a code owner

Assignees


No one assigned


Labels

Extension: curl

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@Sjord@TimWolla

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Disallow newlines in CURLOPT_HTTPHEADER - #22651
Closed
Sjord wants to merge 4 commits into
php:masterfrom 
Sjord:headers-without-newlines
Closed
Disallow newlines in CURLOPT_HTTPHEADER#22651
Sjord wants to merge 4 commits into
php:masterfrom 
Sjord:headers-without-newlines
Conversation
@Sjord
@SjordSjord
commented
Jul 9, 2026

Copy link


Copy Markdown

Contributor
It was possible to have multiple lines in a HTTP headers in a cURL request, which then get interpreted as multiple headers. This commit changes that to throw a ValueError when using newlines or carriage returns in a string passed as header.
@Sjord
Disallow newlines in CURLOPT_HTTPHEADER
8020788
It was possible to have multiple lines in a HTTP headers in a cURL
request, which then get interpreted as multiple headers. This commit
changes that to throw a ValueError when using newlines or carriage
returns in a string passed as header.
@Sjord
Sjord
requested a review
from adoy
as a code ownerJuly 9, 2026 09:38
@Sjord
Sjord
commented
Jul 9, 2026

Copy link


Copy Markdown

ContributorAuthor
Ping @TimWolla (https://news-web.php.net/php.internals/131828)
TimWolla
TimWolla
reviewed
Jul 9, 2026
View reviewed changes
@TimWollaTimWolla
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you!
Comment threadext/curl/interface.c
Outdated

Comment threadext/curl/interface.c
Outdated

Comment threadext/curl/interface.c
Outdated

Sjord
added 2 commits
July 9, 2026 12:23
@Sjord
Change error message, use switch for readability
1846f78
Based on PR review comments. I'll do the NUL byte check separately.
@Sjord
Throw an error on NUL byte in arrays
21fb5b8
This is already done for string options in php_curl_option_str
(see bug #68089). Similarly, array arguments should also not contain NUL
bytes, so we throw the same error for these.
TimWolla
TimWolla
reviewed
Jul 9, 2026
View reviewed changes
Comment threadext/curl/interface.c
Outdated

TimWolla
TimWolla
approved these changes
Jul 9, 2026
View reviewed changes
@TimWollaTimWolla
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, but there were some concerns raised on the mailing list.
Sjord added a commit
to Sjord/php-src
that referenced
this pull request
Jul 10, 2026
@Sjord
Throw an error on null byte in curl array options
32d6e08
This is already done for string options in php_curl_option_str
(see bug #68089). Similarly, array arguments should also not contain
null bytes, so we throw the same error for these.
This was extracted from php#22651, as
this seems less controversial.
Using null bytes is clearly not supported and curl just throws away
everything after the null byte, so
https://wiki.php.net/rfc/policy-exempt-type-value-error-bc-policy seems
to apply here.
@SjordSjord
mentioned this pull request
Jul 10, 2026
 Merged

@Sjord
Sjord
commented
Jul 10, 2026

Copy link


Copy Markdown

ContributorAuthor
I extracted the null byte check to #22662. The newline check needs further discussion.
Girgias pushed a commit
that referenced
this pull request
Jul 10, 2026
@Sjord
Throw an error on null byte in curl array options (#22662)
d1d144e
This is already done for string options in php_curl_option_str
(see bug #68089). Similarly, array arguments should also not contain
null bytes, so we throw the same error for these.
This was extracted from #22651, as
this seems less controversial.
Using null bytes is clearly not supported and curl just throws away
everything after the null byte, so
https://wiki.php.net/rfc/policy-exempt-type-value-error-bc-policy seems
to apply here.
@Sjord
Sjord
commented
Jul 27, 2026

Copy link


Copy Markdown

ContributorAuthor
@mbeccati still objects:
My point of view is that libcurl will eventually take care of it. No pressing need to do anything on our side.
As such, this needs an RFC. I am not feeling like pursuing this currently, so I'll close this for now.
@SjordSjord
closed this
Jul 27, 2026
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@TimWollaTimWollaTimWolla approved these changes
@adoyadoyAwaiting requested review from adoyadoy is a code owner

Assignees


No one assigned


Labels

Extension: curl

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@Sjord@TimWolla

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
Disallow newlines in CURLOPT_HTTPHEADER - #22651
Closed
Sjord wants to merge 4 commits into
php:masterfrom 
Sjord:headers-without-newlines
Closed
Disallow newlines in CURLOPT_HTTPHEADER#22651
Sjord wants to merge 4 commits into
php:masterfrom 
Sjord:headers-without-newlines
Conversation
@Sjord
@SjordSjord
commented
Jul 9, 2026

Copy link


Copy Markdown

Contributor
It was possible to have multiple lines in a HTTP headers in a cURL request, which then get interpreted as multiple headers. This commit changes that to throw a ValueError when using newlines or carriage returns in a string passed as header.
@Sjord
Disallow newlines in CURLOPT_HTTPHEADER
8020788
It was possible to have multiple lines in a HTTP headers in a cURL
request, which then get interpreted as multiple headers. This commit
changes that to throw a ValueError when using newlines or carriage
returns in a string passed as header.
@Sjord
Sjord
requested a review
from adoy
as a code ownerJuly 9, 2026 09:38
@Sjord
Sjord
commented
Jul 9, 2026

Copy link


Copy Markdown

ContributorAuthor
Ping @TimWolla (https://news-web.php.net/php.internals/131828)
TimWolla
TimWolla
reviewed
Jul 9, 2026
View reviewed changes
@TimWollaTimWolla
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you!
Comment threadext/curl/interface.c
Outdated

Comment threadext/curl/interface.c
Outdated

Comment threadext/curl/interface.c
Outdated

Sjord
added 2 commits
July 9, 2026 12:23
@Sjord
Change error message, use switch for readability
1846f78
Based on PR review comments. I'll do the NUL byte check separately.
@Sjord
Throw an error on NUL byte in arrays
21fb5b8
This is already done for string options in php_curl_option_str
(see bug #68089). Similarly, array arguments should also not contain NUL
bytes, so we throw the same error for these.
TimWolla
TimWolla
reviewed
Jul 9, 2026
View reviewed changes
Comment threadext/curl/interface.c
Outdated

TimWolla
TimWolla
approved these changes
Jul 9, 2026
View reviewed changes
@TimWollaTimWolla
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, but there were some concerns raised on the mailing list.
Sjord added a commit
to Sjord/php-src
that referenced
this pull request
Jul 10, 2026
@Sjord
Throw an error on null byte in curl array options
32d6e08
This is already done for string options in php_curl_option_str
(see bug #68089). Similarly, array arguments should also not contain
null bytes, so we throw the same error for these.
This was extracted from php#22651, as
this seems less controversial.
Using null bytes is clearly not supported and curl just throws away
everything after the null byte, so
https://wiki.php.net/rfc/policy-exempt-type-value-error-bc-policy seems
to apply here.
@SjordSjord
mentioned this pull request
Jul 10, 2026
 Merged

@Sjord
Sjord
commented
Jul 10, 2026

Copy link


Copy Markdown

ContributorAuthor
I extracted the null byte check to #22662. The newline check needs further discussion.
Girgias pushed a commit
that referenced
this pull request
Jul 10, 2026
@Sjord
Throw an error on null byte in curl array options (#22662)
d1d144e
This is already done for string options in php_curl_option_str
(see bug #68089). Similarly, array arguments should also not contain
null bytes, so we throw the same error for these.
This was extracted from #22651, as
this seems less controversial.
Using null bytes is clearly not supported and curl just throws away
everything after the null byte, so
https://wiki.php.net/rfc/policy-exempt-type-value-error-bc-policy seems
to apply here.
@Sjord
Sjord
commented
Jul 27, 2026

Copy link


Copy Markdown

ContributorAuthor
@mbeccati still objects:
My point of view is that libcurl will eventually take care of it. No pressing need to do anything on our side.
As such, this needs an RFC. I am not feeling like pursuing this currently, so I'll close this for now.
@SjordSjord
closed this
Jul 27, 2026
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@TimWollaTimWollaTimWolla approved these changes
@adoyadoyAwaiting requested review from adoyadoy is a code owner

Assignees


No one assigned


Labels

Extension: curl

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@Sjord@TimWolla