Fix http splitting vulnerabilities

[auden-woolfson]

Description

Dealing with vulnerabilities found in static scan labeled http splitting vulnerability

https://cwe.mitre.org/data/definitions/113.html

== RELEASE NOTES ==

General Changes
* Throw exception on invalid http headers in async page transport servlet. :pr:`24004`

[steveburnett]

Thanks for the release note entry! Suggest revising to follow the Order of changes in the Release Notes Guidelines. Maybe something like?

== RELEASE NOTES ==

General Changes
* Improve HTTP responses from async page transport servlet, by sanitizing the URI before use. :pr:`24004`

Please revise my suggestion if my phrasing doesn't correctly describe the work you've done.

[ZacBlanco]

Is it possible to write a test which can verify the new behavior?

[pdabre12]

Thanks @auden-woolfson.
I have an initial comment.

[ZacBlanco]

I think this approach is fine, but I wonder how much overhead this has. I'm curious about the impact on request throughput now that we're doing this additional header validation. I'm sure it won't be too high, but if we somehow happen to be sending tons of headers, it could slow things down. A microbenchmark would be nice, but not necessary

[pdabre12]

LGTM, please squash the commits.

[ZacBlanco]

The release note doesn't seem quite accurate

• Improve HTTP responses from async page transport servlet, by sanitizing the URI before use. :pr:24004

We're not really "sanitizing" since we throw an exception. Also, we check the headers only, not the URI. Can you please update it to match? Additionally, is there an associated CVE for this? Or was this some generic check by the security scan? If there is a CVE related, please reference/link it