4 ms·
That happened with the HTTP_PROXY environment variable and the Proxy request header: https://httpoxy.org/ https://httpoxy.org/ Since the CGI "protocol variable
by ademarre 7y ago
That happened with the HTTP_PROXY environment variable and the Proxy request header: https://httpoxy.org/ https://httpoxy.org/
Since the CGI "protocol variables" are actually environment variables, it creates a namespace collision and an injection opportunity for environment variables beginning with "HTTP_".
- aasasd 7y agoWell, putting protocol fields in environment variables, un-namespaced, is one thing CGI hasn't gotten right. That's where FastCGI and SCGI come in. Also, once in a while I begin thinking that PHP is a pretty nice language, certainly doing its job and very performant compared to Python or Ruby, even if PHP code resembles Java more and more. And I forget the numerous questionable semantic-breaking decisions. But then, bam: > Warning: if PHP is running in a SAPI such as Fast CGI, this function will always return the value of an environment variable set by the SAPI, even if putenv() has been used to set a local environment variable of the same name. Use the local_only parameter to return the value of locally-set environment variables.