[arturobernalg]

Validate serialized header fields, including FormattedHeader, to prevent CRLF injection without modifying valid header content.

Add regression tests for both transports, covering requests, responses, and chunked trailers.

[ok2c]

@arturobernalg Why do we need all this?

[arturobernalg]

Why do we need all this?
@ok2c
The issue is that FormattedHeader bypasses BasicLineFormatter, allowing CR/LF in the raw buffer to reach the wire with an explicit charset encoder.

[ok2c]

The issue is that FormattedHeader bypasses BasicLineFormatter, allowing CR/LF in the raw buffer to reach the wire with an explicit charset encoder.

@arturobernalg And to remedy that you suggest we introduce a super expensive scan over each and every header in one of the hottest execution path of the library?

[arturobernalg]

@arturobernalg And to remedy that you suggest we introduce a super expensive scan over each and every header in one of the hottest execution path of the library?

Both classic and async transports preserve CR/LF in a raw FormattedHeader when an explicit UTF-8 encoder is configured. The default path replaces them with ?. Confirmed against clean master.
I agree this edge case does not justify scanning every header. The current patch is too broad.

[arturobernalg]

@ok2c Please check #725