LP #930812: Scrub headers a bit more.

doc/CHANGES.rst

@@ -8,6 +8,8 @@ http://docs.zope.org/zope2/releases/.
 2.13.19 (unreleased)
 --------------------
 
+- LP #930812: Scrub headers a bit more.
+
 - Updated distributions:
 
   - tempstorage = 2.12.2

src/ZPublisher/HTTPResponse.py

@@ -128,7 +128,7 @@ otherTypes = os.environ.get('DONT_GZIP_MAJOR_MIME_TYPES','').lower()
 if otherTypes:
     uncompressableMimeMajorTypes += tuple(otherTypes.split(','))
 
-_CRLF = re.compile(r'\r[\n]?')
+_CRLF = re.compile(r'[\r\n]')
 
 def _scrubHeader(name, value):
     return ''.join(_CRLF.split(str(name))), ''.join(_CRLF.split(str(value)))

src/ZPublisher/tests/testHTTPResponse.py

@@ -431,6 +431,15 @@ class HTTPResponseTests(unittest.TestCase):
                          ('Set-Cookie',
                           'violation="http://www.ietf.org/rfc/rfc2616.txt"')])
 
+    def test_setHeader_drops_LF(self):
+        # Some browsers accept \n in place of \n\r to separate headers,
+        # so we scrub it too.
+        response = self._makeOne()
+        response.setHeader('Location',
+                           'http://www.ietf.org/rfc/\nrfc2616.txt')
+        self.assertEqual(response.headers['location'],
+                         'http://www.ietf.org/rfc/rfc2616.txt')
+
     def test_appendHeader_no_existing(self):
         response = self._makeOne()
         response.appendHeader('foo', 'foo')