Reject line terminators in HttpUtil::IsValidHeaderValue()

net/http/http_util.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // The rules for parsing content-types were borrowed from Firefox:
 // http://lxr.mozilla.org/mozilla/source/netwerk/base/src/nsURLHelper.cpp#834
 
 #include "net/http/http_util.h"
 
 #include <algorithm>
@@ skipping 329 matching lines @@
 }
 
 // static
 bool HttpUtil::IsValidHeaderName(const std::string& name) {
   // Check whether the header name is RFC 2616-compliant.
   return HttpUtil::IsToken(name);
 }
 
 // static
 bool HttpUtil::IsValidHeaderValue(const std::string& value) {
-  // Just a sanity check: disallow NUL and CRLF.
-  return value.find('\0') == std::string::npos &&
-      value.find("\r\n") == std::string::npos;
+  // Just a sanity check: disallow NUL, CR and LF.
+  return value.find_first_of("\0\r\n", 0, 3) == std::string::npos;
 }
 
 // static
 std::string HttpUtil::StripHeaders(const std::string& headers,
                                    const char* const headers_to_remove[],
                                    size_t headers_to_remove_len) {
   std::string stripped_headers;
   HttpUtil::HeadersIterator it(headers.begin(), headers.end(), "\r\n");
 
   while (it.GetNext()) {
@@ skipping 691 matching lines @@
   return true;
 }
 
 bool HttpUtil::NameValuePairsIterator::IsQuote(char c) const {
   if (strict_quotes_)
     return c == '"';
   return HttpUtil::IsQuote(c);
 }
 
 }  // namespace net