Commit ed8ff1ec537 for php.net
commit ed8ff1ec537de9ac3ae0478452d36544c8840400
Author: Daniel Scherzer <daniel.e.scherzer+phpf@gmail.com>
Date: Wed Sep 16 17:38:21 2026 -0700
CLI server: remove "Host" header reflection from response
The server previously responded with a copy of the requested "Host" header in
the response, without any validation. That header, as defined in RFC 9110, is
intended for use in *requests*; remove it from the responses.
diff --git a/ext/curl/tests/curl_setopt_CURLOPT_WRITEHEADER.phpt b/ext/curl/tests/curl_setopt_CURLOPT_WRITEHEADER.phpt
index 8dbc80b4178..1c96fb7c379 100644
--- a/ext/curl/tests/curl_setopt_CURLOPT_WRITEHEADER.phpt
+++ b/ext/curl/tests/curl_setopt_CURLOPT_WRITEHEADER.phpt
@@ -28,7 +28,6 @@
?>
--EXPECTF--
HTTP/1.1 200 OK
-Host: localhost:%d
Date: %s
Connection: close
X-Powered-By: PHP/%s
diff --git a/ext/soap/tests/bugs/bug49278.phpt b/ext/soap/tests/bugs/bug49278.phpt
index 5875ccd3af2..4417ee47f02 100644
--- a/ext/soap/tests/bugs/bug49278.phpt
+++ b/ext/soap/tests/bugs/bug49278.phpt
@@ -51,7 +51,6 @@ function Add() {}
"
string(%s) "HTTP/1.1 200 OK
-Host: %s
Date: %s
Connection: close
X-Powered-By: PHP/%s
diff --git a/sapi/cli/php_cli_server.c b/sapi/cli/php_cli_server.c
index 9f13f064770..9ccee510bb2 100644
--- a/sapi/cli/php_cli_server.c
+++ b/sapi/cli/php_cli_server.c
@@ -359,7 +359,6 @@ static void append_http_status_line(smart_str *buffer, int protocol_version, int
static void append_essential_headers(smart_str* buffer, php_cli_server_client *client, bool persistent, sapi_headers_struct *sapi_headers) /* {{{ */
{
- zval *val;
struct timeval tv = {0};
bool append_date_header = true;
@@ -377,12 +376,6 @@ static void append_essential_headers(smart_str* buffer, php_cli_server_client *c
}
}
- if (NULL != (val = zend_hash_find(&client->request.headers, ZSTR_KNOWN(ZEND_STR_HOST)))) {
- smart_str_appends_ex(buffer, "Host: ", persistent);
- smart_str_append_ex(buffer, Z_STR_P(val), persistent);
- smart_str_appends_ex(buffer, "\r\n", persistent);
- }
-
if (append_date_header && !gettimeofday(&tv, NULL)) {
zend_string *dt = php_format_date("D, d M Y H:i:s", sizeof("D, d M Y H:i:s") - 1, tv.tv_sec, 0);
smart_str_appends_ex(buffer, "Date: ", persistent);
diff --git a/sapi/cli/tests/bug43177.phpt b/sapi/cli/tests/bug43177.phpt
index 6c734e476ab..1ce87454e2e 100644
--- a/sapi/cli/tests/bug43177.phpt
+++ b/sapi/cli/tests/bug43177.phpt
@@ -55,7 +55,6 @@
?>
--EXPECTF--
HTTP/1.1 200 OK
-Host: localhost
Date: %s
Connection: close
X-Powered-By: %s
@@ -63,21 +62,18 @@
OK
HTTP/1.0 500 Internal Server Error
-Host: localhost
Date: %s
Connection: close
X-Powered-By: %s
Content-type: text/html; charset=UTF-8
HTTP/1.0 500 Internal Server Error
-Host: localhost
Date: %s
Connection: close
X-Powered-By: %s
Content-type: text/html; charset=UTF-8
HTTP/1.0 500 Internal Server Error
-Host: localhost
Date: %s
Connection: close
X-Powered-By: %s
diff --git a/sapi/cli/tests/bug65066_100.phpt b/sapi/cli/tests/bug65066_100.phpt
index c5eba532d57..0f0dbffd215 100644
--- a/sapi/cli/tests/bug65066_100.phpt
+++ b/sapi/cli/tests/bug65066_100.phpt
@@ -28,7 +28,6 @@
?>
--EXPECTF--
HTTP/1.1 100 Continue
-Host: %s
Date: %s
Connection: close
X-Powered-By: PHP/%s
diff --git a/sapi/cli/tests/bug65066_422.phpt b/sapi/cli/tests/bug65066_422.phpt
index 3e26866a261..f9e9b05ce7b 100644
--- a/sapi/cli/tests/bug65066_422.phpt
+++ b/sapi/cli/tests/bug65066_422.phpt
@@ -28,7 +28,6 @@
?>
--EXPECTF--
HTTP/1.1 422 Unknown Status Code
-Host: %s
Date: %s
Connection: close
X-Powered-By: PHP/%s
diff --git a/sapi/cli/tests/bug65066_511.phpt b/sapi/cli/tests/bug65066_511.phpt
index 5a8734d8480..77a9a1cf0a4 100644
--- a/sapi/cli/tests/bug65066_511.phpt
+++ b/sapi/cli/tests/bug65066_511.phpt
@@ -28,7 +28,6 @@
?>
--EXPECTF--
HTTP/1.1 511 Network Authentication Required
-Host: %s
Date: %s
Connection: close
X-Powered-By: PHP/%s
diff --git a/sapi/cli/tests/bug66606_2.phpt b/sapi/cli/tests/bug66606_2.phpt
index e599bb64e97..e2ba07bd589 100644
--- a/sapi/cli/tests/bug66606_2.phpt
+++ b/sapi/cli/tests/bug66606_2.phpt
@@ -32,7 +32,6 @@
?>
--EXPECTF--
HTTP/1.1 200 OK
-Host: %s
Date: %s
Connection: close
X-Powered-By: PHP/%s
diff --git a/sapi/cli/tests/bug66830.phpt b/sapi/cli/tests/bug66830.phpt
index ee27b1c6e0f..105bc6f0285 100644
--- a/sapi/cli/tests/bug66830.phpt
+++ b/sapi/cli/tests/bug66830.phpt
@@ -31,7 +31,6 @@
?>
--EXPECTF--
HTTP/1.1 200 OK
-Host: %s
Date: %s
Connection: close
X-Powered-By: %s
diff --git a/sapi/cli/tests/bug71005.phpt b/sapi/cli/tests/bug71005.phpt
index b7b9719d0d0..a92ff28ce0f 100644
--- a/sapi/cli/tests/bug71005.phpt
+++ b/sapi/cli/tests/bug71005.phpt
@@ -33,7 +33,6 @@
?>
--EXPECTF--
HTTP/1.1 200 OK
-Host: %s
Date: %s
Connection: close
X-Powered-By: PHP/%s
diff --git a/sapi/cli/tests/bug73630.phpt b/sapi/cli/tests/bug73630.phpt
index 431b323feb2..ea1f41debf1 100644
--- a/sapi/cli/tests/bug73630.phpt
+++ b/sapi/cli/tests/bug73630.phpt
@@ -35,7 +35,6 @@
?>
--EXPECTF--
HTTP/1.1 200 OK
-Host: %s
Date: %s
Connection: close
X-Powered-By: PHP/%s
diff --git a/sapi/cli/tests/bug81305.phpt b/sapi/cli/tests/bug81305.phpt
index ba6b9ac8c1a..160099359ea 100644
--- a/sapi/cli/tests/bug81305.phpt
+++ b/sapi/cli/tests/bug81305.phpt
@@ -27,7 +27,6 @@
?>
--EXPECTF--
HTTP/1.1 200 OK
-Host: %s
Date: %s
Connection: close
X-Powered-By: PHP/%s
diff --git a/sapi/cli/tests/cli_server_persistent_string002.phpt b/sapi/cli/tests/cli_server_persistent_string002.phpt
index 9c0ae28514b..cdd79d67aae 100644
--- a/sapi/cli/tests/cli_server_persistent_string002.phpt
+++ b/sapi/cli/tests/cli_server_persistent_string002.phpt
@@ -32,7 +32,6 @@
Content-type: text/html; charset=UTF-8
Hello worldHTTP/1.0 200 OK
-Host: hello
Date: %s
Connection: close
X-Powered-By: %s
diff --git a/sapi/cli/tests/gh12363.phpt b/sapi/cli/tests/gh12363.phpt
index 86e92be3170..ec74c9c4907 100644
--- a/sapi/cli/tests/gh12363.phpt
+++ b/sapi/cli/tests/gh12363.phpt
@@ -31,7 +31,6 @@
?>
--EXPECTF--
HTTP/1.1 200 OK
-Host: %s
Connection: close
X-Powered-By: %s
Date: Mon, 25 Mar 1985 00:20:00 GMT
diff --git a/sapi/cli/tests/gh13113.phpt b/sapi/cli/tests/gh13113.phpt
index 5638bdf450d..a0f2a96be9f 100644
--- a/sapi/cli/tests/gh13113.phpt
+++ b/sapi/cli/tests/gh13113.phpt
@@ -28,7 +28,6 @@
?>
--EXPECTF--
HTTP/1.1 200 OK
-Host: %s
Date: %s
Connection: close
X-Powered-By: PHP/%s
diff --git a/sapi/cli/tests/gh18582.phpt b/sapi/cli/tests/gh18582.phpt
index 0c3cebf71c3..9672ac54c58 100644
--- a/sapi/cli/tests/gh18582.phpt
+++ b/sapi/cli/tests/gh18582.phpt
@@ -28,7 +28,6 @@
?>
--EXPECTF--
HTTP/1.1 404 Not Found
-Host: %s
Date: %s
Connection: close
X-Powered-By: %s
diff --git a/sapi/cli/tests/php_cli_server_004.phpt b/sapi/cli/tests/php_cli_server_004.phpt
index 03c7619f1a7..e4c9cf1ee7a 100644
--- a/sapi/cli/tests/php_cli_server_004.phpt
+++ b/sapi/cli/tests/php_cli_server_004.phpt
@@ -32,7 +32,6 @@
?>
--EXPECTF--
HTTP/1.1 200 OK
-Host: %s
Date: %s
Connection: close
X-Powered-By: PHP/%s
diff --git a/sapi/cli/tests/php_cli_server_005.phpt b/sapi/cli/tests/php_cli_server_005.phpt
index 339f2542449..efe0619e37c 100644
--- a/sapi/cli/tests/php_cli_server_005.phpt
+++ b/sapi/cli/tests/php_cli_server_005.phpt
@@ -44,7 +44,6 @@
?>
--EXPECTF--
HTTP/1.1 200 OK
-Host: %s
Date: %s
Connection: close
X-Powered-By: PHP/%s
diff --git a/sapi/cli/tests/php_cli_server_006.phpt b/sapi/cli/tests/php_cli_server_006.phpt
index 7ac36a03f05..cc5aa892a3f 100644
--- a/sapi/cli/tests/php_cli_server_006.phpt
+++ b/sapi/cli/tests/php_cli_server_006.phpt
@@ -28,7 +28,6 @@
?>
--EXPECTF--
HTTP/1.1 200 OK
-Host: %s
Date: %s
Connection: close
X-Powered-By: PHP/%s
diff --git a/sapi/cli/tests/php_cli_server_007.phpt b/sapi/cli/tests/php_cli_server_007.phpt
index b68064a51c5..522612cee5d 100644
--- a/sapi/cli/tests/php_cli_server_007.phpt
+++ b/sapi/cli/tests/php_cli_server_007.phpt
@@ -28,7 +28,6 @@
?>
--EXPECTF--
HTTP/1.1 401 Unauthorized
-Host: %s
Date: %s
Connection: close
X-Powered-By: PHP/%s
diff --git a/sapi/cli/tests/php_cli_server_008.phpt b/sapi/cli/tests/php_cli_server_008.phpt
index 31c9e4ecaf4..81449c941bf 100644
--- a/sapi/cli/tests/php_cli_server_008.phpt
+++ b/sapi/cli/tests/php_cli_server_008.phpt
@@ -44,7 +44,6 @@
?>
--EXPECTF--
HTTP/1.1 200 OK
-Host: %s
Date: %s
Connection: close
X-Powered-By: PHP/%s
@@ -52,7 +51,6 @@
string(8) "HTTP/1.1"
HTTP/1.0 200 OK
-Host: %s
Date: %s
Connection: close
X-Powered-By: PHP/%s
diff --git a/sapi/cli/tests/php_cli_server_009.phpt b/sapi/cli/tests/php_cli_server_009.phpt
index 48f298e7f5b..d305bf63559 100644
--- a/sapi/cli/tests/php_cli_server_009.phpt
+++ b/sapi/cli/tests/php_cli_server_009.phpt
@@ -64,7 +64,6 @@
?>
--EXPECTF--
HTTP/1.1 200 OK
-Host: %s
Date: %s
Connection: close
X-Powered-By: PHP/%s
@@ -72,7 +71,6 @@
string(8) "/foo/bar"
HTTP/1.0 200 OK
-Host: %s
Date: %s
Connection: close
X-Powered-By: PHP/%s
diff --git a/sapi/cli/tests/php_cli_server_010.phpt b/sapi/cli/tests/php_cli_server_010.phpt
index 517fd19add9..1618b1a514f 100644
--- a/sapi/cli/tests/php_cli_server_010.phpt
+++ b/sapi/cli/tests/php_cli_server_010.phpt
@@ -45,7 +45,6 @@
?>
--EXPECTF--
HTTP/1.1 200 OK
-Host: %s
Date: %s
Connection: close
X-Powered-By: PHP/%s
@@ -56,7 +55,6 @@
string(8) "/foo/bar"
string(7) "foo=bar"
HTTP/1.0 200 OK
-Host: %s
Date: %s
Connection: close
X-Powered-By: PHP/%s
diff --git a/sapi/cli/tests/php_cli_server_012.phpt b/sapi/cli/tests/php_cli_server_012.phpt
index 9824c63c404..ecbb5b5173d 100644
--- a/sapi/cli/tests/php_cli_server_012.phpt
+++ b/sapi/cli/tests/php_cli_server_012.phpt
@@ -34,7 +34,6 @@
?>
--EXPECTF--
HTTP/1.1 200 OK
-Host: %s
Date: %s
Connection: close
X-Powered-By: PHP/%s
diff --git a/sapi/cli/tests/php_cli_server_013.phpt b/sapi/cli/tests/php_cli_server_013.phpt
index ab898a402f9..485b8313595 100644
--- a/sapi/cli/tests/php_cli_server_013.phpt
+++ b/sapi/cli/tests/php_cli_server_013.phpt
@@ -124,7 +124,6 @@
?>
--EXPECTF--
HTTP/1.1 404 Not Found
-Host: %s
Date: %s
Connection: close
X-Powered-By: PHP/%s
@@ -134,7 +133,6 @@
<!doctype html><html><head><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><style>AAA</style>
</head><body><h1>Not Found</h1><p>The requested resource <code class="url">/</code> was not found on this server.</p></body></html>
HTTP/1.1 404 Not Found
-Host: %s
Date: %s
Connection: close
X-Powered-By: PHP/%s
@@ -144,7 +142,6 @@
<!doctype html><html><head><meta name="viewport" content="width=device-width, initial-scale=1"><title>404 Not Found</title><style>AAA</style>
</head><body><h1>Not Found</h1><p>The requested resource <code class="url">/main/style.css</code> was not found on this server.</p></body></html>
HTTP/1.1 404 Not Found
-Host: %s
Date: %s
Connection: close
X-Powered-By: PHP/%s
@@ -153,7 +150,6 @@
HTTP/1.1 405 Method Not Allowed
-Host: %s
Date: %s
Connection: close
X-Powered-By: PHP/%s
@@ -164,7 +160,6 @@
<!doctype html><html><head><meta name="viewport" content="width=device-width, initial-scale=1"><title>405 Method Not Allowed</title><style>AAA</style>
</head><body><h1>Method Not Allowed</h1><p>Requested method not allowed.</p></body></html>
HTTP/1.1 405 Method Not Allowed
-Host: %s
Date: %s
Connection: close
X-Powered-By: PHP/%s
@@ -175,7 +170,6 @@
<!doctype html><html><head><meta name="viewport" content="width=device-width, initial-scale=1"><title>405 Method Not Allowed</title><style>AAA</style>
</head><body><h1>Method Not Allowed</h1><p>Requested method not allowed.</p></body></html>
HTTP/1.1 405 Method Not Allowed
-Host: %s
Date: %s
Connection: close
X-Powered-By: PHP/%s
diff --git a/sapi/cli/tests/php_cli_server_014.phpt b/sapi/cli/tests/php_cli_server_014.phpt
index cbe47d1ec69..2c47fe06f77 100644
--- a/sapi/cli/tests/php_cli_server_014.phpt
+++ b/sapi/cli/tests/php_cli_server_014.phpt
@@ -54,7 +54,6 @@
?>
--EXPECTF--
HTTP/1.1 200 OK
-Host: %s
Date: %s
Connection: close
X-Powered-By: %s
@@ -62,7 +61,6 @@
done
HTTP/1.1 200 OK
-Host: %s
Date: %s
Connection: close
X-Powered-By: PHP/%s
diff --git a/sapi/cli/tests/php_cli_server_015.phpt b/sapi/cli/tests/php_cli_server_015.phpt
index 5821fdbbc2e..d7d8a5ec867 100644
--- a/sapi/cli/tests/php_cli_server_015.phpt
+++ b/sapi/cli/tests/php_cli_server_015.phpt
@@ -34,7 +34,6 @@
?>
--EXPECTF--
HTTP/1.1 200 OK
-Host: %s
Date: %s
Connection: close
X-Powered-By: PHP/%s
diff --git a/sapi/cli/tests/php_cli_server_017.phpt b/sapi/cli/tests/php_cli_server_017.phpt
index 7e54d9ef36c..d325c435d73 100644
--- a/sapi/cli/tests/php_cli_server_017.phpt
+++ b/sapi/cli/tests/php_cli_server_017.phpt
@@ -31,7 +31,6 @@
?>
--EXPECTF--
HTTP/1.1 200 OK
-Host: %s
Date: %s
Connection: close
X-Powered-By: %s
diff --git a/sapi/cli/tests/php_cli_server_018.phpt b/sapi/cli/tests/php_cli_server_018.phpt
index 9ed16c13958..cf177835407 100644
--- a/sapi/cli/tests/php_cli_server_018.phpt
+++ b/sapi/cli/tests/php_cli_server_018.phpt
@@ -31,7 +31,6 @@
?>
--EXPECTF--
HTTP/1.1 200 OK
-Host: %s
Date: %s
Connection: close
X-Powered-By: %s
diff --git a/sapi/cli/tests/php_cli_server_019.phpt b/sapi/cli/tests/php_cli_server_019.phpt
index ce74c79535e..c423a44a26b 100644
--- a/sapi/cli/tests/php_cli_server_019.phpt
+++ b/sapi/cli/tests/php_cli_server_019.phpt
@@ -35,7 +35,6 @@
?>
--EXPECTF--
HTTP/1.1 200 OK
-Host: %s
Date: %s
Connection: close
X-Powered-By: %s
diff --git a/sapi/cli/tests/php_cli_server_020.phpt b/sapi/cli/tests/php_cli_server_020.phpt
index e4e53263532..fced18df651 100644
--- a/sapi/cli/tests/php_cli_server_020.phpt
+++ b/sapi/cli/tests/php_cli_server_020.phpt
@@ -27,7 +27,6 @@
?>
--EXPECTF--
HTTP/1.1 200 OK
-Host: %s
Date: %s
Connection: close
X-Powered-By: PHP/%s
diff --git a/sapi/cli/tests/php_cli_server_021.phpt b/sapi/cli/tests/php_cli_server_021.phpt
index 6269871b4c8..3598080b6ce 100644
--- a/sapi/cli/tests/php_cli_server_021.phpt
+++ b/sapi/cli/tests/php_cli_server_021.phpt
@@ -26,7 +26,6 @@
?>
--EXPECTF--
HTTP/1.1 200 OK
-Host: %s
Date: %s
Connection: close
X-Powered-By: PHP/%s
diff --git a/sapi/cli/tests/php_cli_server_022.phpt b/sapi/cli/tests/php_cli_server_022.phpt
index 763a2036fcd..d54c92d9c1a 100644
--- a/sapi/cli/tests/php_cli_server_022.phpt
+++ b/sapi/cli/tests/php_cli_server_022.phpt
@@ -34,7 +34,6 @@
?>
--EXPECTF--
HTTP/1.1 200 OK
-Host: %s
Date: %s
Connection: close
X-Powered-By: %s
diff --git a/sapi/cli/tests/php_cli_server_023.phpt b/sapi/cli/tests/php_cli_server_023.phpt
index 0b8cc9d790b..a5370309745 100644
--- a/sapi/cli/tests/php_cli_server_023.phpt
+++ b/sapi/cli/tests/php_cli_server_023.phpt
@@ -32,7 +32,6 @@
?>
--EXPECTF--
HTTP/1.1 200 OK
-Host: Foo Bar Baz
Date: %s
Connection: close
X-Powered-By: %s
diff --git a/sapi/cli/tests/php_cli_server_query_method.phpt b/sapi/cli/tests/php_cli_server_query_method.phpt
index 58ce95bfd1e..bca88448b6e 100644
--- a/sapi/cli/tests/php_cli_server_query_method.phpt
+++ b/sapi/cli/tests/php_cli_server_query_method.phpt
@@ -31,7 +31,6 @@
?>
--EXPECTF--
HTTP/1.1 200 OK
-Host: %s
Date: %s
Connection: close
X-Powered-By: %s
diff --git a/sapi/cli/tests/upload_2G.phpt b/sapi/cli/tests/upload_2G.phpt
index 2b4729d4f86..651f21f7941 100644
--- a/sapi/cli/tests/upload_2G.phpt
+++ b/sapi/cli/tests/upload_2G.phpt
@@ -89,7 +89,6 @@
--EXPECTF--
Test
HTTP/1.1 200 OK
-Host: %s
Date: %s
Connection: close
X-Powered-By: PHP/%s