error on CR or LF, instead of substitution

Author: geemus

lib/excon/connection.rb

@@ -139,7 +139,10 @@ def request_call(datum)
           # add headers to request
           datum[:headers].each do |key, values|
             [values].flatten.each do |value|
-              request << key.to_s << ': ' << value.to_s.gsub(/\r\n/, ' ') << CR_NL
+              if value.to_s.match(/[\r\n]/)
+                raise Excon::Errors::InvalidHeaderValue.new('\r and \n are forbidden')
+              end
+              request << key.to_s << ': ' << value.to_s << CR_NL
             end
           end
 
@@ -185,7 +188,7 @@ def request_call(datum)
         end
       rescue => error
         case error
-        when Excon::Errors::StubNotFound, Excon::Errors::Timeout
+        when Excon::Errors::InvalidHeaderValue, Excon::Errors::StubNotFound, Excon::Errors::Timeout
           raise(error)
         else
           raise_socket_error(error)

lib/excon/error.rb

@@ -45,6 +45,7 @@ def initialize(socket_error = Excon::Error.new)
       end
     end
 
+    class InvalidHeaderValue < Error; end
     class Timeout < Error; end
     class ResponseParse < Error; end
     class ProxyParse < Error; end

tests/bad_tests.rb

@@ -2,21 +2,13 @@
 
   with_server('bad') do
 
-    tests('prevents header splitting').returns(true) do
+    tests('prevents header splitting').raises(Excon::Errors::InvalidHeaderValue) do
       connection = Excon.new('http://127.0.0.1:9292')
-      request = <<-BODY
-GET /echo HTTP/1.1\r
-User-Agent: excon/0.62.0\r
-Foo: bar Baz: qux\r
-Host: 127.0.0.1:9292\r
-\r
-BODY
-      response = connection.request(
+      connection.request(
         headers: { Foo: "bar\r\nBaz: qux" },
         method:  :get,
         path: '/echo'
       )
-      response.body == request
     end
 
     tests('bad server: causes EOFError') do