Validate the header value before injecting it

Author: humitos

readthedocs/proxito/middleware.py

@@ -15,6 +15,7 @@
 )
 from django.conf import settings
 from django.core.exceptions import SuspiciousOperation
+from django.http.response import BadHeaderError, ResponseHeaders
 from django.shortcuts import redirect
 from django.urls import reverse
 from django.utils.deprecation import MiddlewareMixin
@@ -369,14 +370,25 @@ def _get_https_redirect(self, request):
         return None
 
     def add_resolver_headers(self, request, response):
-        # TODO: find a better way to re-use the unresolved URL so we don't
-        # query the db multiple times on the same request.
-        # https://github.com/readthedocs/readthedocs.org/issues/10456
         if hasattr(request, "unresolved_url") and request.unresolved_url is not None:
             # TODO: add more ``X-RTD-Resolver-*`` headers
-            response["X-RTD-Resolver-Filename"] = escape(
-                request.unresolved_url.filename
-            )
+            header_value = escape(request.unresolved_url.filename)
+            try:
+                # Use Django internals to validate the header's value before injecting it.
+                ResponseHeaders({})._convert_to_charset(
+                    header_value,
+                    "latin-1",
+                    mime_encode=True,
+                )
+
+                response["X-RTD-Resolver-Filename"] = header_value
+            except BadHeaderError:
+                # Skip adding the header because it fails validation
+                log.info(
+                    "Skip adding X-RTD-Resolver-Filename header due to invalid value.",
+                    filename=request.unresolved_url.filename,
+                    value=header_value,
+                )
 
     def process_response(self, request, response):  # noqa
         self.add_proxito_headers(request, response)

readthedocs/proxito/tests/test_old_redirects.py

@@ -1352,6 +1352,7 @@ def test_redirect_exact_with_wildcard_crossdomain(self):
             r = self.client.get(url, headers={"host": "project.dev.readthedocs.io"})
             self.assertEqual(r.status_code, 302, url)
             self.assertEqual(r["Location"], expected_location, url)
+            self.assertNotIn("X-RTD-Resolver-Filename", r.headers)
 
     def test_redirect_html_to_clean_url_crossdomain(self):
         """