Deprecate resource requests whose URLs contain raw newlines.

third_party/WebKit/Source/core/loader/FrameFetchContext.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 825 matching lines @@
     }
   }
 
   // Check for mixed content. We do this second-to-last so that when folks block
   // mixed content with a CSP policy, they don't get a warning. They'll still
   // get a warning in the console about CSP blocking the load.
   if (MixedContentChecker::shouldBlockFetch(frame(), resourceRequest, url,
                                             reportingPolicy))
     return ResourceRequestBlockedReason::MixedContent;
 
+  if (url.whitespaceRemoved()) {
+    Deprecation::countDeprecation(
+        frame()->document(), UseCounter::CanRequestURLHTTPContainingNewline);
+    if (url.protocolIsInHTTPFamily()) {
+      if (RuntimeEnabledFeatures::restrictCanRequestURLCharacterSetEnabled())
+        return ResourceRequestBlockedReason::Other;
+    } else {
+      UseCounter::count(frame()->document(),
+                        UseCounter::CanRequestURLNonHTTPContainingNewline);
+    }
+  }
+
   // Let the client have the final say into whether or not the load should
   // proceed.
   DocumentLoader* documentLoader = masterDocumentLoader();
   if (documentLoader && documentLoader->subresourceFilter() &&
       type != Resource::MainResource && type != Resource::ImportResource) {
     if (!documentLoader->subresourceFilter()->allowLoad(
             url, resourceRequest.requestContext(), reportingPolicy)) {
       return ResourceRequestBlockedReason::SubresourceFilter;
     }
   }
@@ skipping 209 matching lines @@
   return frame()->frameScheduler()->loadingTaskRunner();
 }
 
 DEFINE_TRACE(FrameFetchContext) {
   visitor->trace(m_document);
   visitor->trace(m_documentLoader);
   FetchContext::trace(visitor);
 }
 
 }  // namespace blink