Make sure that HttpRequestHeaders contains valid key-value pairs.

chrome/browser/extensions/api/downloads/downloads_api.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/extensions/api/downloads/downloads_api.h"
 
 #include <set>
 #include <string>
 
 #include "base/basictypes.h"
@@ skipping 68 matching lines @@
 
 namespace download_extension_errors {
 
 const char kEmptyFile[] = "Filename not yet determined";
 const char kFileAlreadyDeleted[] = "Download file already deleted";
 const char kFileNotRemoved[] = "Unable to remove file";
 const char kIconNotFound[] = "Icon not found";
 const char kInvalidDangerType[] = "Invalid danger type";
 const char kInvalidFilename[] = "Invalid filename";
 const char kInvalidFilter[] = "Invalid query filter";
-const char kInvalidHeader[] = "Invalid request header";
+const char kInvalidHeaderName[] = "Invalid request header name";
+const char kInvalidHeaderUnsafe[] = "Unsafe request header name";
+const char kInvalidHeaderValue[] = "Invalid request header value";
 const char kInvalidId[] = "Invalid downloadId";
 const char kInvalidOrderBy[] = "Invalid orderBy field";
 const char kInvalidQueryLimit[] = "Invalid query limit";
 const char kInvalidState[] = "Invalid state";
 const char kInvalidURL[] = "Invalid URL";
 const char kInvisibleContext[] = "Javascript execution context is not visible "
   "(tab, window, popup bubble)";
 const char kNotComplete[] = "Download must be complete";
 const char kNotDangerous[] = "Download must be dangerous";
 const char kNotInProgress[] = "Download must be in progress";
@@ skipping 929 matching lines @@
   if (options.save_as.get())
     download_params->set_prompt(*options.save_as.get());
 
   if (options.headers.get()) {
     typedef downloads::HeaderNameValuePair HeaderNameValuePair;
     for (std::vector<linked_ptr<HeaderNameValuePair> >::const_iterator iter =
          options.headers->begin();
          iter != options.headers->end();
          ++iter) {
       const HeaderNameValuePair& name_value = **iter;
+      if (!net::HttpUtil::IsValidHeaderName(name_value.name)) {
+        error_ = errors::kInvalidHeaderName;
+        return false;
+      }
       if (!net::HttpUtil::IsSafeHeader(name_value.name)) {
-        error_ = errors::kInvalidHeader;
+        error_ = errors::kInvalidHeaderUnsafe;
+        return false;
+      }
+      if (!net::HttpUtil::IsValidHeaderValue(name_value.value)) {
+        error_ = errors::kInvalidHeaderValue;
         return false;
       }
       download_params->add_request_header(name_value.name, name_value.value);
     }
   }
 
   std::string method_string =
       downloads::ToString(options.method);
   if (!method_string.empty())
     download_params->set_method(method_string);
@@ skipping 870 matching lines @@
     const Extension* extension,
     UnloadedExtensionInfo::Reason reason) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   std::set<const Extension*>::iterator iter =
       shelf_disabling_extensions_.find(extension);
   if (iter != shelf_disabling_extensions_.end())
     shelf_disabling_extensions_.erase(iter);
 }
 
 }  // namespace extensions