net/http/cgi: reject invalid header names [freeze exception]

[FiloSottile]

While working on CL 231419, I noticed we trim spaces around the names of the headers generated by CGI programs. This is not as serious as #34540 because the CGI program output is presumably trusted, but CGI is such a generic interface that I'd feel better if we didn't do anything potentially risky like that.

I'd like to request a freeze exception to land CL 232277 this week.

/cc @andybons @rsc

[gopherbot]

Change https://golang.org/cl/232277 mentions this issue: net/http/cgi: reject invalid header names

[andybons]

I think this is OK as it’s small and security related. Will wait for @rsc to confirm.

[rsc]

SGTM, thanks.