net/http: outbound trailer names lack validation

[neild]

We will produce an error if the user attempts to send a request with an invalid header name such as X-Header: x\r\nX-Another-Header. However, we don't validate the names of trailers. In the HTTP/1 path, this permits the user to perform header injection or similar shenanigans on an outbound request.

This doesn't seem to be an exploitable vulnerability under any likely scenario, since the user would need to be acquiring header names from an attacker-controlled source, but it's still something we should catch.

[odeke-em]

I've mailed out CL https://go-review.googlesource.com/c/go/+/572615

[gopherbot]

Change https://go.dev/cl/572615 mentions this issue: net/http: validate outgoing/client request trailers

[gopherbot]

Change https://go.dev/cl/572655 mentions this issue: http2: validate client/outgoing trailers

[gopherbot]

Change https://go.dev/cl/572676 mentions this issue: src/go.mod, net/http: update bundled+latest golang.org/x/net