Escape new-lines in Cookie and P3P headers

This is relevant difference between CGI 3.62 and 3.63.

See <https://bugzilla.redhat.com/show_bug.cgi?id=876974>.

diff --git a/cpan/CGI/lib/CGI.pm b/cpan/CGI/lib/CGI.pm

index d8d91f4..5bc9b17 100644

--- a/cpan/CGI/lib/CGI.pm

+++ b/cpan/CGI/lib/CGI.pm

@@ -1497,8 +1497,17 @@ sub header {

                             'EXPIRES','NPH','CHARSET',

                             'ATTACHMENT','P3P'],@p);

+    # Since $cookie and $p3p may be array references,

+    # we must stringify them before CR escaping is done.

+    my @cookie;

+    for (ref($cookie) eq 'ARRAY' ? @{$cookie} : $cookie) {

+        my $cs = UNIVERSAL::isa($_,'CGI::Cookie') ? $_->as_string : $_;

+        push(@cookie,$cs) if defined $cs and $cs ne '';

+    }

+    $p3p = join ' ',@$p3p if ref($p3p) eq 'ARRAY';

+

     # CR escaping for values, per RFC 822

-    for my $header ($type,$status,$cookie,$target,$expires,$nph,$charset,$attachment,$p3p,@other) {

+    for my $header ($type,$status,@cookie,$target,$expires,$nph,$charset,$attachment,$p3p,@other) {

         if (defined $header) {

             # From RFC 822:

             # Unfolding  is  accomplished  by regarding   CRLF   immediately

@@ -1542,18 +1551,9 @@ sub header {

     push(@header,"Status: $status") if $status;

     push(@header,"Window-Target: $target") if $target;

-    if ($p3p) {

-       $p3p = join ' ',@$p3p if ref($p3p) eq 'ARRAY';

-       push(@header,qq(P3P: policyref="/w3c/p3p.xml", CP="$p3p"));

-    }

+    push(@header,"P3P: policyref=\"/w3c/p3p.xml\", CP=\"$p3p\"") if $p3p;

     # push all the cookies -- there may be several

-    if ($cookie) {

-	my(@cookie) = ref($cookie) && ref($cookie) eq 'ARRAY' ? @{$cookie} : $cookie;

-	for (@cookie) {

-            my $cs = UNIVERSAL::isa($_,'CGI::Cookie') ? $_->as_string : $_;

-	    push(@header,"Set-Cookie: $cs") if $cs ne '';

-	}

-    }

+    push(@header,map {"Set-Cookie: $_"} @cookie);

     # if the user indicates an expiration time, then we need

     # both an Expires and a Date header (so that the browser is

     # uses OUR clock)

diff --git a/t/headers.t b/t/headers.t

index 661b74b..4b4922c 100644

--- a/cpan/CGI/t/headers.t

+++ b/cpan/CGI/t/headers.t

@@ -22,6 +22,12 @@ like($@,qr/contains a newline/,'invalid header blows up');

 like $cgi->header( -type => "text/html".$CGI::CRLF." evil: stuff " ),

     qr#Content-Type: text/html evil: stuff#, 'known header, with leading and trailing whitespace on the continuation line';

+eval { $cgi->header( -p3p => ["foo".$CGI::CRLF."bar"] ) };

+like($@,qr/contains a newline/,'P3P header with CRLF embedded blows up');

+

+eval { $cgi->header( -cookie => ["foo".$CGI::CRLF."bar"] ) };

+like($@,qr/contains a newline/,'Set-Cookie header with CRLF embedded blows up');

+

 eval { $cgi->header( -foobar => "text/html".$CGI::CRLF."evil: stuff" ) };

 like($@,qr/contains a newline/,'unknown header with CRLF embedded blows up');