Stdlib: mail.add_x_header emits X-PHP-Originating-Script (#21433)

ext/standard/VmIni.php

@@ -97,7 +97,6 @@ final class VmIni
         'disable_functions',
         'disable_classes',
         'open_basedir',
-        'mail.add_x_header',
         'error_append_string',
         'error_prepend_string',
         'upload_tmp_dir',
@@ -118,7 +117,6 @@ final class VmIni
         'user_dir',
         'disable_functions',
         'disable_classes',
-        'mail.add_x_header',
     ];
 
     /** @var list<string> */
@@ -245,6 +243,9 @@ public static function get(Context $ctx, string $option) {
 
             return '';
         }
+        if ('mail.add_x_header' === $key) {
+            return self::formatRegisterArgcArgvIniGet(self::$mailAddXHeader);
+        }
         if (in_array($key, self::EMPTY_STRING_INI_KEYS, true)) {
             return '';
         }
@@ -409,6 +410,9 @@ public static function getUnserializeMaxDepth(): int
 
     private static string $maxExecutionTime = self::CFG_MAX_EXECUTION_TIME;
 
+    /** php-src PG(mail_x_header) — mail.add_x_header (#21433). */
+    private static bool $mailAddXHeader = false;
+
     /** php-src PG(register_argc_argv) — startup/-d only; runtime ini_set() returns false (#4515). */
     private static bool $registerArgcArgv = true;
 
@@ -443,6 +447,11 @@ public static function applyStartupIniOverride(string $option, string $value): b
 
             return true;
         }
+        if ('mail.add_x_header' === $key) {
+            self::$mailAddXHeader = self::parseBoolIni($value);
+
+            return true;
+        }
         if ('phar.readonly' === $key) {
             \PHPCompiler\ext\phar\VmPhar::setStartupReadonly(self::parseBoolIni($value));
 
@@ -452,6 +461,12 @@ public static function applyStartupIniOverride(string $option, string $value): b
         return false;
     }
 
+    /** php-src PG(mail_x_header) for mail() X-PHP-Originating-Script (#21433). */
+    public static function mailAddXHeaderEnabled(): bool
+    {
+        return self::$mailAddXHeader;
+    }
+
     /** Observable ini_get('max_execution_time') after set_time_limit / ini_set (#12481). */
     public static function syncMaxExecutionTime(int $seconds): void
     {

ext/standard/VmMail.php

@@ -265,6 +265,9 @@ public static function send(
                 $headers = null;
             }
         }
+        if (VmIni::mailAddXHeaderEnabled()) {
+            $headers = self::prependOriginatingScriptHeader($frame, $headers);
+        }
 
         $sendmailPath = VmIniIntrospection::mirroredHostIniGet('sendmail_path');
         if (null === $sendmailPath || '' === $sendmailPath) {
@@ -302,6 +305,27 @@ public static function send(
         return true;
     }
 
+    /**
+     * php-src php_mail() PG(mail_x_header) — X-PHP-Originating-Script (#21433).
+     */
+    private static function prependOriginatingScriptHeader(Frame $frame, ?string $headers): string
+    {
+        $sep = "\r\n";
+        $uid = VmProcessIdentityNative::getuid() ?? 0;
+        $script = $frame->scriptPath;
+        if ('' === $script || '-' === $script || str_starts_with($script, 'Command line')) {
+            $base = 'Command line code';
+        } else {
+            $base = VmString::basename($script);
+        }
+        $origin = 'X-PHP-Originating-Script: '.$uid.':'.$base;
+        if (null !== $headers && '' !== $headers) {
+            return $origin.$sep.$headers;
+        }
+
+        return $origin;
+    }
+
     /**
      * php-src mail.c — trim trailing whitespace; replace bare control chars with space
      * while preserving RFC822 long-header CRLF+WSP folding.

test/compliance/cases/stdlib/mail_add_x_header.phpt

@@ -0,0 +1,24 @@
+--TEST--
+stdlib mail.add_x_header X-PHP-Originating-Script (#21433, ext/standard/mail.c)
+--INI--
+sendmail_path={PWD}/mail_fixtures/mock_sendmail.sh
+mail.add_x_header=1
+--FILE--
+<?php
+$mock = ini_get('sendmail_path');
+$out = dirname($mock) . '/mock_sendmail.last';
+@unlink($out);
+var_export(ini_get('mail.add_x_header'));
+echo "\n";
+$ok = mail('user@example.com', 'Hello', "Body\n", ['From' => 'noreply@example.com']);
+var_export($ok);
+echo "\n";
+$raw = is_file($out) ? file_get_contents($out) : '';
+echo (str_contains($raw, 'X-PHP-Originating-Script:') ? 'has_x' : 'no_x'), "\n";
+echo (str_contains($raw, 'From: noreply@example.com') ? 'has_from' : 'no_from'), "\n";
+@unlink($out);
+--EXPECT--
+'1'
+true
+has_x
+has_from

test/compliance/cases/stdlib/mail_add_x_header_off.phpt

@@ -0,0 +1,19 @@
+--TEST--
+stdlib mail.add_x_header=0 omits X-PHP-Originating-Script (#21433)
+--INI--
+sendmail_path={PWD}/mail_fixtures/mock_sendmail.sh
+mail.add_x_header=0
+--FILE--
+<?php
+$mock = ini_get('sendmail_path');
+$out = dirname($mock) . '/mock_sendmail.last';
+@unlink($out);
+var_export(ini_get('mail.add_x_header'));
+echo "\n";
+mail('user@example.com', 'Hello', "Body\n", 'From: noreply@example.com');
+$raw = is_file($out) ? file_get_contents($out) : '';
+echo (str_contains($raw, 'X-PHP-Originating-Script:') ? 'has_x' : 'no_x'), "\n";
+@unlink($out);
+--EXPECT--
+'0'
+no_x

test/repro/issue_21433_mail_add_x_header.php

@@ -0,0 +1,23 @@
+<?php
+
+/**
+ * Repro #21433 — mail.add_x_header emits X-PHP-Originating-Script.
+ *
+ *   php bin/vm.php -d sendmail_path=…/mock_sendmail.sh -d mail.add_x_header=1 \
+ *     test/repro/issue_21433_mail_add_x_header.php
+ */
+$mock = ini_get('sendmail_path');
+$out = dirname($mock).'/mock_sendmail.last';
+@unlink($out);
+if ('1' !== ini_get('mail.add_x_header') && 'On' !== ini_get('mail.add_x_header')) {
+    fwrite(STDERR, 'BAD_INI '.var_export(ini_get('mail.add_x_header'), true)."\n");
+    exit(1);
+}
+mail('a@b.c', 's', 'body', 'From: x@y');
+$raw = is_file($out) ? file_get_contents($out) : '';
+if (!str_contains($raw, 'X-PHP-Originating-Script:')) {
+    fwrite(STDERR, "MISSING_HEADER\n");
+    exit(1);
+}
+echo "OK\n";
+@unlink($out);