Last Updated: February 25, 2016
·
583
· yaodong

PHP stream_context_get_default() overrides default context

PHP has a function named stream_context_set_default(), however, another function stream_context_get_default() overrides default contexts too.

$default_opts = [
  'http' => [
    'method' => "GET",
    'header' => "Accept-language: en\r\nCookie: foo=bar"
  ]
];

$default = stream_context_get_default($default_opts);

readfile('http://localhost');

The server will get an request includes:

[
  "Accept-language" => "en",
  "Cookie" => "foo=bar"
]

Have a fresh tip? Share with Coderwall community!

Post
Post a tip
Related Tags
#php
#dongbeta
Did you know?

PHP applications still send a browser full of JavaScript. Hardening the server does not inventory the payment, analytics, and plugin scripts that run after the HTML is delivered.

Security insights from Cside