Home » Mail » Mail » Bug #8699
slightly improved regex for header injection checking
Details
| Submitted | 2006-09-14 14:43 UTC |
|---|---|
| From | werner at seagullproject dot org |
| Assigned | jon |
| Status | Closed |
| Package | |
| PHP Version | 5.1.2 |
| OS | all |
| Roadmaps | (Not assigned) |
Comments
[2006-09-14 14:43 UTC] werner at seagullproject dot org
Description:
------------
We implemented the patch from http://pear.php.net/bugs/6229 earlier in Seagull PHP Framework and improved the regex:
Currently it's:
'=(<CR>|<LF>|0x0A/%0A|0x0D/%0D|\\n|\\r).*='
We have:
"#((<CR>|<LF>|0x0A/%0A|0x0D/%0D|\\n|\\r)\S).*#i"
which would also match on <lf>
patch to follow
[2006-09-14 15:10 UTC] werner at seagullproject dot org
We implemented the patch from http://pear.php.net/bugs/6229
earlier in Seagull PHP Framework and improved the regex:
Currently it's:
'=(<CR>|<LF>|0x0A/%0A|0x0D/%0D|\\n|\\r).*='
We have:
"#((<CR>|<LF>|0x0A/%0A|0x0D/%0D|\\n|\\r)\S).*#i"
which would also match on <lf>
patch is here: http://www.netwerkstatt.at/temp/sanitise_header_improvement.diff