Escape non-ASCII Request header values before attaching them as a NetLog string.

net/http/http_request_headers.cc

Index: net/http/http_request_headers.cc
diff --git a/net/http/http_request_headers.cc b/net/http/http_request_headers.cc
index 8e667fc4886f854a1566d95ae5c2552e1756426f..a9671486cf359763082672a03efe97e6db15b090 100644
--- a/net/http/http_request_headers.cc
+++ b/net/http/http_request_headers.cc
@@ -11,6 +11,7 @@
 #include "base/strings/string_util.h"
 #include "base/strings/stringprintf.h"
 #include "base/values.h"
+#include "net/base/escape.h"
 #include "net/http/http_log_util.h"
 #include "net/http/http_util.h"
 #include "net/log/net_log_capture_mode.h"
@@ -188,14 +189,15 @@ std::unique_ptr<base::Value> HttpRequestHeaders::NetLogCallback(
     const std::string* request_line,
     NetLogCaptureMode capture_mode) const {
   std::unique_ptr<base::DictionaryValue> dict(new base::DictionaryValue());
-  dict->SetString("line", *request_line);
+  dict->SetString("line", EscapeNonASCII(*request_line));
   base::ListValue* headers = new base::ListValue();
-  for (HeaderVector::const_iterator it = headers_.begin();
-       it != headers_.end(); ++it) {
+  for (HeaderVector::const_iterator it = headers_.begin(); it != headers_.end();
+       ++it) {
     std::string log_value =
         ElideHeaderValueForNetLog(capture_mode, it->key, it->value);
+    std::string escaped_value = EscapeNonASCII(log_value);

[mmenke, 2016/10/18 19:12:33]

Would it make sense to use EscapeNonASCII on the output of base::StringPrintf
instead?  I'm fine either way, but not sure what sort of sanitizing we do on
header names set by XHRs.

[eroman, 2016/10/18 19:21:52]

I was aiming for consistency with how HttpResponseHeaders does it:
 
https://cs.chromium.org/chromium/src/net/http/http_response_headers.cc?rcl=0&...

I went ahead and escaped the header name in the same manner for consistency, but
I want to circle back on this, since it doesn't feel right.

 * I don't think our code should be generating/allowing for non-ASCII values in
request headers. Certainly the Digest case doesn't feel right. Whether our XHR
code from blink allows this is certainly something worth looking into.

 * I would like a more uniform approach to how we handle this in the netlogs,
but will propose such a refactor separately so as not to conflate issues.

[mmenke, 2016/10/18 20:11:19]

This all sounds reasonable to me.

     headers->AppendString(
-        base::StringPrintf("%s: %s", it->key.c_str(), log_value.c_str()));
+        base::StringPrintf("%s: %s", it->key.c_str(), escaped_value.c_str()));
   }
   dict->Set("headers", headers);
   return std::move(dict);