CVE-2019-17513

@@ -39,7 +39,7 @@ buildscript {
 }
 
 allprojects {
-  version = "1.7.5-SNAPSHOT"
+  version = "1.7.5"
 }
 
 ext {

@@ -0,0 +1,42 @@
+/*
+ * Copyright 2019 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package ratpack.http
+
+import ratpack.test.internal.RatpackGroovyDslSpec
+
+class ResponseHeaderValidationSpec extends RatpackGroovyDslSpec {
+
+  def "invalid header values yield exception"() {
+    when:
+    handlers {
+      all {
+        try {
+          header("Test", "value\r\nAnotherHeader: another value")
+          render "ok"
+        } catch (e) {
+          render e.toString()
+        }
+      }
+    }
+
+    then:
+    def response = get()
+    response.headers.names == ['content-type', 'content-length'].toSet()
+    response.body.text == "java.lang.IllegalArgumentException: only ' ' and '\\t' are allowed after '\\n': value\r\nAnotherHeader: another value"
+  }
+
+}

@@ -156,7 +156,7 @@ private void newRequest(ChannelHandlerContext ctx, HttpRequest nettyRequest) thr
       channel.attr(CLIENT_CERT_KEY).get()
     );
 
-    HttpHeaders nettyHeaders = new DefaultHttpHeaders(false);
+    HttpHeaders nettyHeaders = new DefaultHttpHeaders();
     MutableHeaders responseHeaders = new NettyHeadersBackedMutableHeaders(nettyHeaders);
     AtomicBoolean transmitted = new AtomicBoolean(false);