Disallow newlines in reason (#9167) (#9198)

(cherry picked from commit 88f3834)

CHANGES/9167.bugfix.rst

@@ -0,0 +1 @@
+Rejected `\n` in `reason` values to avoid sending broken HTTP messages -- by :user:`Dreamsorcerer`.

aiohttp/web_response.py

@@ -145,6 +145,8 @@ def set_status(
                 reason = HTTPStatus(self._status).phrase
             except ValueError:
                 reason = ""
+        if "\n" in reason:
+            raise ValueError("Reason cannot contain \\n")
         self._reason = reason
 
     @property

tests/test_web_exceptions.py

@@ -270,3 +270,8 @@ def test_unicode_text_body_unauthorized() -> None:
     ):
         resp = web.HTTPUnauthorized(body="text")
     assert resp.status == 401
+
+
+def test_multiline_reason() -> None:
+    with pytest.raises(ValueError, match=r"Reason cannot contain \\n"):
+        web.HTTPOk(reason="Bad\r\nInjected-header: foo")

tests/test_web_response.py

@@ -945,14 +945,14 @@ async def test_start_force_close() -> None:
 
 async def test___repr__() -> None:
     req = make_request("GET", "/path/to")
-    resp = StreamResponse(reason=301)
+    resp = StreamResponse(reason="foo")
     await resp.prepare(req)
-    assert "<StreamResponse 301 GET /path/to >" == repr(resp)
+    assert "<StreamResponse foo GET /path/to >" == repr(resp)
 
 
 def test___repr___not_prepared() -> None:
-    resp = StreamResponse(reason=301)
-    assert "<StreamResponse 301 not prepared>" == repr(resp)
+    resp = StreamResponse(reason="foo")
+    assert "<StreamResponse foo not prepared>" == repr(resp)
 
 
 async def test_keep_alive_http10_default() -> None:
@@ -1226,6 +1226,11 @@ async def test_render_with_body(buf, writer) -> None:
     )
 
 
+async def test_multiline_reason(buf, writer) -> None:
+    with pytest.raises(ValueError, match=r"Reason cannot contain \\n"):
+        Response(reason="Bad\r\nInjected-header: foo")
+
+
 async def test_send_set_cookie_header(buf, writer) -> None:
     resp = Response()
     resp.cookies["name"] = "value"