ZPublisher.HTTPRequest._scrubHeader allows linefeed injection

[David Glick]

The Zope HTTPResponse APIs for setting response headers use a "_scrubHeader" helper to make sure carriage returns and CRLFs can't be injected into headers.

However it doesn't strip linefeeds (when not following carriage returns), which still allows for header injection with user agents that aren't strict about accepting only CRLF as a header delimiter.

For example, the following sets a cookie in Firefox when it receives the response:

user_input = '\nSet-Cookie: foo=bar' # from a form or query string
response.redirect('some/path?input=' + user_input)

[David Glick (davisagli)]

Proposed patch attached.

[Tres Seaver (tseaver)]

RFC 2616, section 2.2, disallows LF in TEXT, tokens, separators, or
quoted text, which are the only legitimate productons for header values
(section 4.2). We should therefore be OK in stripping bare LFs from
header values.

See http://www.ietf.org/rfc/rfc2616.txt