Core: Validate header names and values to prevent CRLF injection #2180

Environment details

1. Core - HttpHeaders in google-http-client
2. OS type and version: Any
3. Java version: Any (Java 8+)
4. google-http-client version: 2.1.1 and earlier

Problem Statement

HttpHeaders does not validate header names or values for carriage return (\r) or line feed (\n) characters. If untrusted input is passed into header names or values, an attacker can inject CRLF sequences leading to HTTP Response Splitting or Header Injection.

Steps to reproduce

1. Create a HttpHeaders instance with a header name or value containing \r\n.
2. Serialize headers into a low-level HTTP request using HttpHeaders.serializeHeaders(...).
3. Observe that the injected header line is accepted without error.

Proposed Fix

Reject header names or values containing CRLF in HttpHeaders.addHeader():

if (name.contains("\r") || name.contains("\n") || stringValue.contains("\r") || stringValue.contains("\n")) {
  throw new IllegalArgumentException("Header name or value contains CRLF characters.");
}

Regression tests (testSerializeHeaders_crlfInjectionInName and testSerializeHeaders_crlfInjectionInValue) are included in the accompanying PR.