Reset HTTP/2 stream on line-folded response headers.

net/spdy/header_coalescer.cc

 // Copyright (c) 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/spdy/header_coalescer.h"
 
 #include <utility>
 
 #include "base/strings/string_util.h"
 
@@ skipping 21 matching lines @@
 
   if (key[0] == ':') {
     if (regular_header_seen_) {
       error_seen_ = true;
       return;
     }
   } else {
     regular_header_seen_ = true;
   }
 
+  // Line folding is forbidden by RFC 7230 Section 3.2.4.

[Ryan Hamilton, 2016/07/27 23:36:58]

Can we simply check for \r\n? It seems like that's an illegal sequence in
HTTP/1.1 since that is the end of line delimiter?

[Bence, 2016/08/01 14:06:17]

I agree.  Done.

+  if (value.find("\r\n ") != base::StringPiece::npos ||
+      value.find("\r\n\t") != base::StringPiece::npos) {
+    error_seen_ = true;
+    return;
+  }
+
   auto iter = headers_.find(key);
   if (iter == headers_.end()) {
     headers_[key] = value;
   } else {
     // This header had multiple values, so it must be reconstructed.
     base::StringPiece v = iter->second;
     std::string s(v.data(), v.length());
     if (key == "cookie") {
       // Obeys section 8.1.2.5 in RFC 7540 for cookie reconstruction.
       s.append("; ");
     } else {
       base::StringPiece("\0", 1).AppendToString(&s);
     }
     value.AppendToString(&s);
     headers_.ReplaceOrAppendHeader(key, s);
   }
 }
 
 SpdyHeaderBlock HeaderCoalescer::release_headers() {
   DCHECK(headers_valid_);
   headers_valid_ = false;
   return std::move(headers_);
 }
 
 }  // namespace net