Disallow newlines in reason

aiohttp/web_exceptions.py

@@ -99,6 +99,8 @@ def __init__(
         super().__init__()
         if reason is None:
             reason = self.default_reason
+        elif "\n" in reason:
+            raise ValueError("Reason cannot contain \\n")
 
         if text is None:
             if not self.empty_body:

aiohttp/web_response.py

@@ -165,6 +165,8 @@ def set_status(
                 reason = HTTPStatus(self._status).phrase
             except ValueError:
                 reason = ""
+        if "\n" in reason:
+            raise ValueError("Reason cannot contain \\n")
         self._reason = reason
 
     @property

tests/test_web_exceptions.py

@@ -183,6 +183,10 @@ def test_ctor_all(self) -> None:
         assert resp.reason == "Done"
         assert resp.status == 200
 
+    def test_multiline_reason(self) -> None:
+        with pytest.raises(ValueError, match=r"Reason cannot contain \\n"):
+            web.HTTPOk(reason="Bad\r\nInjected-header: foo")
+
     def test_pickle(self) -> None:
         resp = web.HTTPOk(
             headers={"X-Custom": "value"},

tests/test_web_response.py

@@ -1076,6 +1076,12 @@ async def test_render_with_body(buf: Any, writer: Any) -> None:
     )
 
 
+async def test_multiline_reason(buf: Any, writer: Any) -> None:
+    req = make_request("GET", "/", writer=writer)
+    with pytest.raises(ValueError, match=r"Reason cannot contain \\n"):
+        Response(reason="Bad\r\nInjected-header: foo")
+
+
 async def test_send_set_cookie_header(buf: Any, writer: Any) -> None:
     resp = Response()
     resp.cookies["name"] = "value"