str.encode('base64') != base64.b64encode()

Add check for newlines in request headers.

Closes #246

diff --git a/tornado/simple_httpclient.py b/tornado/simple_httpclient.py
index c34f75589400cda2f36239da549115a81d7f552a..906461bb576d43a6831e093715ba0d401831b4ce 100644 (file)
--- a/tornado/simple_httpclient.py
+++ b/tornado/simple_httpclient.py
@@ -8,6 +8,7 @@ from tornado.ioloop import IOLoop
 from tornado.iostream import IOStream, SSLIOStream
 from tornado import stack_context
 
+import base64
 import collections
 import contextlib
 import copy
@@ -197,7 +198,7 @@ class _HTTPConnection(object):
         if username is not None:
             auth = "%s:%s" % (username, password)
             self.request.headers["Authorization"] = ("Basic %s" %
-                                                     auth.encode("base64"))
+                                                     base64.b64encode(auth))
         if self.request.user_agent:
             self.request.headers["User-Agent"] = self.request.user_agent
         has_body = self.request.method in ("POST", "PUT")
@@ -217,7 +218,10 @@ class _HTTPConnection(object):
         request_lines = ["%s %s HTTP/1.1" % (self.request.method,
                                              req_path)]
         for k, v in self.request.headers.get_all():
-            request_lines.append("%s: %s" % (k, v))
+            line = "%s: %s" % (k, v)
+            if '\n' in line:
+                raise ValueError('Newline in header: ' + repr(line))
+            request_lines.append(line)
         self.stream.write("\r\n".join(request_lines) + "\r\n\r\n")
         if has_body:
             self.stream.write(self.request.body)