Fix HTTP response splitting via unvalidated reason phrase in dart:io

[Sengtocxoen]

Problem

HttpResponse.reasonPhrase in dart:io accepts CRLF characters without validation. Every other HTTP wire-output API in the SDK validates against CRLF via _isValueChar() / _validateValue(). The reasonPhrase setter is the single gap.

An attacker who controls the value passed to reasonPhrase can inject CRLF sequences to split the HTTP response, injecting arbitrary headers and response bodies.

API consistency

// Headers: VALIDATED — throws FormatException on CRLF
response.headers.set('X-Test', 'value\r\nInjected'); // FormatException

// Reason phrase: NOT VALIDATED before this fix
response.reasonPhrase = 'OK\r\nInjected: header\r\n\r\n<script>alert(1)</script>'; // silently accepted

Fix

Adds CRLF validation to the reasonPhrase setter using the existing _HttpHeaders._isValidValueString() function — the same validation already applied to all header values in http_headers.dart.

 void set reasonPhrase(String reasonPhrase) {
   if (_outgoing.headersWritten) throw StateError("Header already sent");
+  var errorAt = _HttpHeaders._isValidValueString(reasonPhrase);
+  if (errorAt >= 0) {
+    throw FormatException(
+      "Invalid HTTP reason phrase",
+      reasonPhrase,
+      errorAt,
+    );
+  }
   _reasonPhrase = reasonPhrase;
 }

Zero new validation infrastructure — reuses the existing _isValidValueString() that rejects bytes <= 31 (CR, LF, NUL) except HT.

Impact

• Header injection: Set-Cookie, Access-Control-Allow-Origin, CSP override
• Response body injection / XSS: CRLF + CRLF terminates headers, body controlled by attacker
• Cache poisoning: Inject a complete second HTTP response into the stream

Validation

headers.set('X', 'a\r\nb') → FormatException (existing, correct behavior)
reasonPhrase = 'OK\r\n...' → now also throws FormatException (new, consistent)

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[mraleph]

Please fix CLA issue and make sure to add a regression test.

[copybara-service]

Thank you for your contribution! This project uses Gerrit for code reviews. Your pull request has automatically been converted into a code review at:

https://dart-review.googlesource.com/c/sdk/+/508540

Please wait for a developer to review your code review at the above link; you can speed up the review if you sign into Gerrit and manually add a reviewer that has recently worked on the relevant code. See CONTRIBUTING.md to learn how to upload changes to Gerrit directly.

Additional commits pushed to this PR will update both the PR and the corresponding Gerrit CL. After the review is complete on the CL, your reviewer will merge the CL (automatically closing this PR).

[copybara-service]

Thank you for your contribution! This project uses Gerrit for code reviews. Your pull request has automatically been converted into a code review at:

https://dart-review.googlesource.com/c/sdk/+/508560

Please wait for a developer to review your code review at the above link; you can speed up the review if you sign into Gerrit and manually add a reviewer that has recently worked on the relevant code. See CONTRIBUTING.md to learn how to upload changes to Gerrit directly.

Additional commits pushed to this PR will update both the PR and the corresponding Gerrit CL. After the review is complete on the CL, your reviewer will merge the CL (automatically closing this PR).

[mraleph]

Please add a regression test, as I have asked above.

[copybara-service]

https://dart-review.googlesource.com/c/sdk/+/508560 has been updated with the latest commits from this pull request.

[copybara-service]

https://dart-review.googlesource.com/c/sdk/+/508560 has been updated with the latest commits from this pull request.

[Sengtocxoen]

I miss the test first time, i hope it ok now

[copybara-service]

Gerrit CL has build or test failures, please review them in Gerrit and fix them before requesting another review.

[mraleph]

@Sengtocxoen would you like to fix test failures?

[copybara-service]

https://dart-review.googlesource.com/c/sdk/+/508560 has been updated with the latest commits from this pull request.

[copybara-service]

https://dart-review.googlesource.com/c/sdk/+/508560 has been updated with the latest commits from this pull request.

[copybara-service]

Gerrit CL has build or test failures, please review them in Gerrit and fix them before requesting another review.

[copybara-service]

Gerrit CL has build or test failures, please review them in Gerrit and fix them before requesting another review.

[copybara-service]

Gerrit CL has build or test failures, please review them in Gerrit and fix them before requesting another review.

[copybara-service]

Gerrit CL has build or test failures, please review them in Gerrit and fix them before requesting another review.

[mraleph]

@Sengtocxoen would you like to fix test failures? (also when addressing test failures please rerun tests locally to make sure you have fixed all things!)

[copybara-service]

https://dart-review.googlesource.com/c/sdk/+/508560 has been updated with the latest commits from this pull request.

[copybara-service]

https://dart-review.googlesource.com/c/sdk/+/508560 has been updated with the latest commits from this pull request.

[copybara-service]

Gerrit CL has build or test failures, please review them in Gerrit and fix them before requesting another review.

[copybara-service]

https://dart-review.googlesource.com/c/sdk/+/508560 has been updated with the latest commits from this pull request.

[copybara-service]

Gerrit CL has build or test failures, please review them in Gerrit and fix them before requesting another review.

[copybara-service]

https://dart-review.googlesource.com/c/sdk/+/508560 has been updated with the latest commits from this pull request.

[copybara-service]

Gerrit CL has build or test failures, please review them in Gerrit and fix them before requesting another review.

[copybara-service]

https://dart-review.googlesource.com/c/sdk/+/508560 has been updated with the latest commits from this pull request.

[copybara-service]

https://dart-review.googlesource.com/c/sdk/+/508560 has been updated with the latest commits from this pull request.

[copybara-service]

Gerrit CL has build or test failures, please review them in Gerrit and fix them before requesting another review.

[Sengtocxoen]

@mraleph i think i broke some things that the CL don't run the checking for me any more, can you help me that. Thank you a lot

[copybara-service]

CL has been abandoned, possibly because it was rejected. Please refer to the CL for more information.

[mraleph]

This needs to be rebased. You can just delete changes to CHANGELOG.md, they are not necessary.

[copybara-service]

https://dart-review.googlesource.com/c/sdk/+/508560 has been updated with the latest commits from this pull request.

[copybara-service]

Gerrit CL has build or test failures, please review them in Gerrit and fix them before requesting another review.

[copybara-service]

https://dart-review.googlesource.com/c/sdk/+/508560 has been updated with the latest commits from this pull request.

[copybara-service]

Gerrit CL has build or test failures, please review them in Gerrit and fix them before requesting another review.