Merge pull request #1274 from TimWolla/psr-7-header-validation

Add PSR-7 erratum "Validation of Header Names and Values"

Author: Jean85

accepted/PSR-7-http-message-meta.md

@@ -647,3 +647,47 @@ used to populate the headers of an HTTP message.
 * Anton Serdyuk
 * Phil Sturgeon
 * Chris Wilkinson
+
+## 7. Errata
+
+### 7.1 Validation of Header Names and Values
+
+Some special characters within the name or value of an HTTP header might affect
+the parsing of the serialized message in a way that the contents of unrelated
+headers are changed. This misparsing can open up an application to security
+vulnerabilities. A common type of vulnerability is CRLF injection, allowing
+an attacker to inject additional headers or to end the list of headers early.
+
+For this reason classes implementing the `MessageInterface` SHOULD strictly
+validate the header names and contents according to the most recent HTTP
+specification ([RFC 7230#3.2][1] at the time of writing). The implementation
+SHOULD reject invalid values and SHOULD NOT make any attempt to automatically
+correct the provided values.
+
+A minimally viable validator is expected to reject header names containing the
+following characters:
+
+- NUL (0x00)
+- `\r` (0x0D)
+- `\n` (0x0A)
+- Any character less than or equal to 0x20.
+
+Further characters or sequences in header names should be rejected according
+to the HTTP specification.
+
+A minimally viable validator is expected to reject header values containing the
+following characters:
+
+- NUL (0x00)
+- `\r` (0x0D)
+- `\n` (0x0A)
+
+If compatibility with older systems is desired then the sequence `\r\n` (0x0D0A)
+within a header value MAY be accepted if and only if it is immediately followed
+by either SPACE (0x20) or `\t` (0x09). The full sequence SHOULD then internally
+be normalized to a single SPACE (0x20).
+
+Further characters or sequences in header values should be rejected according
+to the HTTP specification.
+
+[1]: https://datatracker.ietf.org/doc/html/rfc7230#section-3.2

accepted/PSR-7-http-message.md

@@ -75,6 +75,8 @@ referring to these interfaces.
 
 ### 1.2 HTTP Headers
 
+[cf. [errata](PSR-7-http-message-meta#71-validation-of-header-names-and-values)]
+
 #### Case-insensitive header field names
 
 HTTP messages include case-insensitive header field names. Headers are retrieved