Replace dangerous characters in response headers

src/libraries/System.Net.Http/src/System/Net/Http/Headers/HeaderDescriptor.cs

@@ -15,6 +15,9 @@ namespace System.Net.Http.Headers
     // Use HeaderDescriptor.TryGet to resolve an arbitrary header name to a HeaderDescriptor.
     internal readonly struct HeaderDescriptor : IEquatable<HeaderDescriptor>
     {
+        private static readonly SearchValues<char> s_dangerousCharacters = SearchValues.Create('\0', '\r', '\n');
+        private static readonly SearchValues<byte> s_dangerousCharacterBytes = SearchValues.Create((byte)'\0', (byte)'\r', (byte)'\n');
+
         /// <summary>
         /// Either a <see cref="KnownHeader"/> or <see cref="string"/>.
         /// </summary>
@@ -129,7 +132,21 @@ public HeaderDescriptor AsCustomHeader()
             return new HeaderDescriptor(Name, customHeader: true);
         }
 
-        public string GetHeaderValue(ReadOnlySpan<byte> headerValue, Encoding? valueEncoding)
+        private readonly ref struct CreateHeaderStringState
+        {
+            public readonly ReadOnlySpan<byte> Bytes;
+            public readonly Encoding Encoding;
+            public readonly bool ReplaceDangerousCharacters;
+
+            public CreateHeaderStringState(ReadOnlySpan<byte> bytes, Encoding encoding, bool replaceDangerousCharacters)
+            {
+                Bytes = bytes;
+                Encoding = encoding;
+                ReplaceDangerousCharacters = replaceDangerousCharacters;
+            }
+        }
+
+        public string GetHeaderValue(ReadOnlySpan<byte> headerValue, Encoding? valueEncoding, bool replaceDangerousCharacters = false)
         {
             if (headerValue.Length == 0)
             {
@@ -169,7 +186,18 @@ public string GetHeaderValue(ReadOnlySpan<byte> headerValue, Encoding? valueEnco
                 }
             }
 
-            return (valueEncoding ?? HttpRuleParser.DefaultHttpEncoding).GetString(headerValue);
+            Encoding encoding = valueEncoding ?? HttpRuleParser.DefaultHttpEncoding;
+            replaceDangerousCharacters = replaceDangerousCharacters && headerValue.IndexOfAny(s_dangerousCharacterBytes) >= 0;
+            int length = encoding.GetCharCount(headerValue);
+            return string.Create(length, new CreateHeaderStringState(headerValue, encoding, replaceDangerousCharacters), static (chars, s) =>
+            {
+                int doubleCheck = s.Encoding.GetChars(s.Bytes, chars);
+                Debug.Assert(chars.Length == doubleCheck);
+                if (s.ReplaceDangerousCharacters)
+                {
+                    chars.ReplaceAny(s_dangerousCharacters, ' ');
+                }
+            });
         }
 
         internal static string? GetKnownContentType(ReadOnlySpan<byte> contentTypeValue)

src/libraries/System.Net.Http/src/System/Net/Http/SocketsHttpHandler/HttpConnectionBase.cs

@@ -131,7 +131,7 @@ public string GetResponseHeaderValueWithCaching(HeaderDescriptor descriptor, Rea
             return
                 descriptor.Equals(KnownHeaders.Date) ? GetOrAddCachedValue(ref _lastDateHeaderValue, descriptor, value, valueEncoding) :
                 descriptor.Equals(KnownHeaders.Server) ? GetOrAddCachedValue(ref _lastServerHeaderValue, descriptor, value, valueEncoding) :
-                descriptor.GetHeaderValue(value, valueEncoding);
+                descriptor.GetHeaderValue(value, valueEncoding, replaceDangerousCharacters: true);
 
             static string GetOrAddCachedValue([NotNull] ref string? cache, HeaderDescriptor descriptor, ReadOnlySpan<byte> value, Encoding? encoding)
             {

src/libraries/System.Net.Http/tests/FunctionalTests/HttpClientHandlerTest.Headers.cs

@@ -5,11 +5,10 @@
 using System.IO;
 using System.Linq;
 using System.Net.Http.Headers;
-using System.Net.Quic;
 using System.Net.Test.Common;
 using System.Text;
 using System.Threading.Tasks;
-
+using Microsoft.DotNet.XUnitExtensions;
 using Xunit;
 using Xunit.Abstractions;
 
@@ -160,7 +159,8 @@ await LoopbackServerFactory.CreateClientAndServerAsync(async uri =>
                     // Client should abort at some point so this is going to throw.
                     HttpRequestData requestData = await server.HandleRequestAsync(HttpStatusCode.OK).ConfigureAwait(false);
                 }
-                catch (Exception) { };
+                catch (Exception) { }
+                ;
             });
         }
 
@@ -595,5 +595,39 @@ await connection.SendResponseAsync(HttpStatusCode.OK,
                 });
             });
         }
+
+        [ConditionalTheory]
+        [InlineData(false, "test\nxwow\nmore\n")]
+        [InlineData(false, "test\rwow\rmore\r")]
+        [InlineData(false, "test\r\nwow\r\nmore\r\n")]
+        [InlineData(true, "one\0two\0three\0")]
+        public async Task SendAsync_InvalidCharactersInResponseHeader_ReplacedWithSpaces(bool testHttp11, string value)
+        {
+            if (!testHttp11 && UseVersion == HttpVersion.Version11)
+            {
+                throw new SkipTestException("This case is not valid for HTTP 1.1");
+            }
+
+            string expectedValue = value.Replace('\r', ' ').Replace('\n', ' ').Replace('\0', ' ');
+            await LoopbackServerFactory.CreateClientAndServerAsync(
+                async uri =>
+                {
+                    using HttpClient client = CreateHttpClient();
+
+                    using HttpRequestMessage request = new HttpRequestMessage(HttpMethod.Get, uri)
+                    {
+                        Version = UseVersion,
+                        VersionPolicy = HttpVersionPolicy.RequestVersionExact
+                    };
+
+                    using HttpResponseMessage response = await client.SendAsync(request);
+                    Assert.Equal(expectedValue, response.Headers.GetValues("test").Single());
+                },
+                async server =>
+                {
+                    List<HttpHeaderData> headers = [new HttpHeaderData("test", value)];
+                    HttpRequestData requestData = await server.AcceptConnectionSendResponseAndCloseAsync(additionalHeaders: headers);
+                });
+        }
     }
 }