Make sure that HttpRequestHeaders contains valid key-value pairs.

chrome/browser/extensions/api/downloads/downloads_api_browsertest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Disable everything on windows only. http://crbug.com/306144
 #ifndef OS_WIN
 
 #include <algorithm>
 
 #include "base/file_util.h"
@@ skipping 1585 matching lines @@
     "sEc-",
     "pRoxY-probably-not-evil",
     "sEc-probably-not-evil",
     "oRiGiN",
     "Access-Control-Request-Headers",
     "Access-Control-Request-Method",
   };
 
   for (size_t index = 0; index < arraysize(kUnsafeHeaders); ++index) {
     std::string download_url = test_server()->GetURL("slow?0").spec();
-    EXPECT_STREQ(errors::kInvalidHeader,
+    EXPECT_STREQ(errors::kInvalidHeaderUnsafe,
                   RunFunctionAndReturnError(new DownloadsDownloadFunction(),
                                             base::StringPrintf(
         "[{\"url\": \"%s\","
         "  \"filename\": \"unsafe-header-%d.txt\","
         "  \"headers\": [{"
         "    \"name\": \"%s\","
         "    \"value\": \"unsafe\"}]}]",
         download_url.c_str(),
         static_cast<int>(index),
         kUnsafeHeaders[index])).c_str());
   }
 }
 
+// Tests that invalid header names and values are rejected.
+IN_PROC_BROWSER_TEST_F(DownloadExtensionTest,
+                       DownloadExtensionTest_Download_InvalidHeaders) {
+  LoadExtension("downloads_split");
+  ASSERT_TRUE(StartEmbeddedTestServer());
+  ASSERT_TRUE(test_server()->Start());
+  GoOnTheRecord();
+  std::string download_url = test_server()->GetURL("slow?0").spec();
+  EXPECT_STREQ(errors::kInvalidHeaderName,
+               RunFunctionAndReturnError(new DownloadsDownloadFunction(),
+                                         base::StringPrintf(
+      "[{\"url\": \"%s\","
+      "  \"filename\": \"unsafe-header-crlf.txt\","
+      "  \"headers\": [{"
+      "    \"name\": \"Header\\r\\nSec-Spoof: Hey\\r\\nX-Split:X\","
+      "    \"value\": \"unsafe\"}]}]",
+      download_url.c_str())).c_str());
+
+  EXPECT_STREQ(errors::kInvalidHeaderValue,
+               RunFunctionAndReturnError(new DownloadsDownloadFunction(),
+                                         base::StringPrintf(
+      "[{\"url\": \"%s\","
+      "  \"filename\": \"unsafe-header-crlf.txt\","
+      "  \"headers\": [{"
+      "    \"name\": \"Invalid-value\","
+      "    \"value\": \"hey\\r\\nSec-Spoof: Hey\"}]}]",
+      download_url.c_str())).c_str());
+}
+
 #if defined(OS_WIN)
 #define MAYBE_DownloadExtensionTest_Download_Subdirectory\
         DISABLED_DownloadExtensionTest_Download_Subdirectory
 #else
 #define MAYBE_DownloadExtensionTest_Download_Subdirectory\
         DownloadExtensionTest_Download_Subdirectory
 #endif
 IN_PROC_BROWSER_TEST_F(DownloadExtensionTest,
                        MAYBE_DownloadExtensionTest_Download_Subdirectory) {
   LoadExtension("downloads_split");
@@ skipping 2495 matching lines @@
   EXPECT_EQ(downloads::FILENAME_CONFLICT_ACTION_PROMPT, conflict_action);
   EXPECT_FALSE(warnings.empty());
   EXPECT_EQ(ExtensionWarning::kDownloadFilenameConflict,
             warnings.begin()->warning_type());
   EXPECT_EQ("incumbent", warnings.begin()->extension_id());
 }
 
 }  // namespace extensions
 
 #endif  // http://crbug.com/3061144