Unusual but valid headers in requests are not available to PHP when running via CGI

[TFLI-DB]

Description

The following code:

<?php
print_r($_SERVER);

Requested with:

curl -s -H 'X-Test: 1' -H 'X-%%Test%%: 1' 'http://127.0.0.1/' | grep 'HTTP_'

Resulted in this output:

[HTTP_X_TEST] => 1
[HTTP_ACCEPT] => */*
[HTTP_USER_AGENT] => curl/7.83.1
[HTTP_HOST] => 127.0.0.1

But I expected this output instead:

[HTTP_X_TEST] => 1
[HTTP_X_%%TEST%%] => 1
[HTTP_ACCEPT] => */*
[HTTP_USER_AGENT] => curl/7.83.1
[HTTP_HOST] => 127.0.0.1

This appears to be unique to CGI, or alternatively mod_php is immune.

PHP Version

PHP 8.1.26

Operating System

Alpine Linux 3.18

[ranvis]

It can be the HTTP server that filters those headers.
I tried with CGI and FastCGI(fpm) SAPI on (old) Apache with LogLevel trace1, and got the following error log from both:
[core:trace1] [pid 5963:tid 139973923698432] util_script.c(78): [client 127.0.0.1:54301] Not exporting header with invalid name as envvar: %Test%%
https://github.com/apache/httpd/blob/88afb529ab8db358cbb5b9dd84744772a727876d/server/util_script.c#L68-L82

[TFLI-DB]

@ranvis I'm not aware of a way to inspect the raw request as PHP sees it to completely rule this out as a possibility. What I have noticed is that PHP compiled and running as an Apache module does not filter these headers which would suggest it's not strictly an Apache issue.

[ranvis]

@TFLI-DB I'm sorry if my comment just confused you.
But you may want to mention the HTTP server setup so that people can make the same environment.
For Apache and mod_cgi/mod_proxy_fcgi I tried, Apachethe modules filters request headers before sending to PHP.

[TFLI-DB]

@ranvis No problem. The CGI/mod_php difference is cited in the bug report but perhaps it was too brief. Do you know what module/setting in apache is stripping the headers for you? I can check my environments to see if they have the same settings and then update this issue with my findings.

[TFLI-DB]

To expand on this the function apache_request_headers will return these headers but only while PHP is running via mod_php. I have yet to find a way to get access to the headers at all via CGI.

[ranvis]

@TFLI-DB

Do you know what module/setting in apache is stripping the headers for you?

It is hard-coded.

fyi, CGI SAPI has apache_request_headers() too, while CLI SAPI doesn't.

Edit: I mean, plain CLI, not CLI-server.