Make net::HttpRequestHeaders::AddHeadersFromString split on NL

net/http/http_request_headers.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 //
 // HttpRequestHeaders manages the request headers.
 // It maintains these in a vector of header key/value pairs, thereby maintaining
 // the order of the headers.  This means that any lookups are linear time
 // operations.
 
 #ifndef NET_HTTP_HTTP_REQUEST_HEADERS_H_
@@ skipping 94 matching lines @@
   // Sets the header value pair for |key| and |value|, if |key| does not exist.
   // If |key| already exists, the call is a no-op.
   // When comparing |key|, case is ignored.
   void SetHeaderIfMissing(const base::StringPiece& key,
                           const base::StringPiece& value);
 
   // Removes the first header that matches (case insensitive) |key|.
   void RemoveHeader(const base::StringPiece& key);
 
   // Parses the header from a string and calls SetHeader() with it.  This string
-  // should not contain any CRLF.  As per RFC7230 Section 3.2, the format is:
+  // should not contain any CRLF.  Individual CR and LF are also prohibited.
+  // As per RFC7230 Section 3.2, the format is:
   //
   // header-field   = field-name ":" OWS field-value OWS
   //
   // field-name     = token
   // field-value    = *( field-content / obs-fold )
   // field-content  = field-vchar [ 1*( SP / HTAB ) field-vchar ]
   // field-vchar    = VCHAR / obs-text
   //
   // obs-fold       = CRLF 1*( SP / HTAB )
   //                ; obsolete line folding
   //                ; see Section 3.2.4
   //
   // AddHeaderFromString() will trim any LWS surrounding the
   // field-content.
   void AddHeaderFromString(const base::StringPiece& header_line);
 
   // Same thing as AddHeaderFromString() except that |headers| is a "\r\n"
   // delimited string of header lines.  It will split up the string by "\r\n"
-  // and call AddHeaderFromString() on each.
+  // and call AddHeaderFromString() on each.  Individual "\r" and "\n" are also
+  // treated as delimeters, to protect against "header smuggling", but callers
+  // should always use "\r\n" as the delimiter.
   void AddHeadersFromString(const base::StringPiece& headers);
 
   // Calls SetHeader() on each header from |other|, maintaining order.
   void MergeFrom(const HttpRequestHeaders& other);
 
   // Copies from |other| to |this|.
   void CopyFrom(const HttpRequestHeaders& other) {
     *this = other;
   }
 
@@ skipping 30 matching lines @@
   // Allow the copy construction and operator= to facilitate copying in
   // HttpRequestHeaders.
   // TODO(willchan): Investigate to see if we can remove the need to copy
   // HttpRequestHeaders.
   // DISALLOW_COPY_AND_ASSIGN(HttpRequestHeaders);
 };
 
 }  // namespace net
 
 #endif  // NET_HTTP_HTTP_REQUEST_HEADERS_H_