mirror of
https://github.com/php/php-src.git
synced 2026-10-29 10:22:06 +08:00
Daniel Scherzer
ed8ff1ec53
The server previously responded with a copy of the requested "Host" header in the response, without any validation. That header, as defined in RFC 9110, is intended for use in *requests*; remove it from the responses.
45 lines
600 B
PHP
45 lines
600 B
PHP
--TEST--
|
|
Built-in web server reflects arbitrary `Host` headers
|
|
--SKIPIF--
|
|
<?php
|
|
include "skipif.inc";
|
|
?>
|
|
--FILE--
|
|
<?php
|
|
include "php_cli_server.inc";
|
|
php_cli_server_start(<<<'PHP'
|
|
echo "Request headers:\n";
|
|
var_dump(getallheaders());
|
|
PHP
|
|
);
|
|
|
|
$req = <<<END
|
|
GET / HTTP/1.1
|
|
Host: Foo Bar Baz
|
|
|
|
|
|
|
|
END;
|
|
|
|
$fp = php_cli_server_connect();
|
|
if (fwrite($fp, $req)) {
|
|
while (!feof($fp)) {
|
|
echo fgets($fp);
|
|
}
|
|
}
|
|
fclose($fp);
|
|
|
|
?>
|
|
--EXPECTF--
|
|
HTTP/1.1 200 OK
|
|
Date: %s
|
|
Connection: close
|
|
X-Powered-By: %s
|
|
Content-type: text/html; charset=UTF-8
|
|
|
|
Request headers:
|
|
array(1) {
|
|
["Host"]=>
|
|
string(11) "Foo Bar Baz"
|
|
}
|