Fix http splitting vulnerabilities

[auden-woolfson]

Description

Dealing with vulnerabilities found in static scan labeled http splitting vulnerability

== RELEASE NOTES ==

General Changes
* Improve HTTP responses from async page transport servlet, by sanitizing the URI before use. :pr:`24004`

[steveburnett]

Thanks for the release note entry! Suggest revising to follow the Order of changes in the Release Notes Guidelines. Maybe something like?

== RELEASE NOTES ==

General Changes
* Improve HTTP responses from async page transport servlet, by sanitizing the URI before use. :pr:`24004`

Please revise my suggestion if my phrasing doesn't correctly describe the work you've done.

[czentgr]

So this removes \r and \n from the URI. But having these chars would not be a valid URI in the first place. The server listener doesn't filter this out already?
The vulnerability talks about having these values in the header - because these values are used to separate header and body in HTTP.

Validating the input is fine. Just surprised this isn't already taken care of.

[pdabre12]

+1.
We need to sanitize the request headers in order to handle this vulnerability.

[auden-woolfson]

So just to clarify, you are suggesting I get all headers from the request variable and sanitize each one using the same method here?

[ZacBlanco]

Is it possible to write a test which can verify the new behavior?