Reject CR/LF in multipart boundary

A custom boundary is interpolated into the part separators as-is, so a
boundary containing CR/LF could forge part headers in the same way as
the field name and filename.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: hsbt

lib/net/http/generic_request.rb

@@ -336,6 +336,9 @@ def encode_multipart_form_data(out, params, opt)
     boundary = opt[:boundary]
     require 'securerandom' unless defined?(SecureRandom)
     boundary ||= SecureRandom.urlsafe_base64(40)
+    if /[\r\n]/.match?(boundary.to_s)
+      raise ArgumentError, "multipart boundary cannot include CR/LF"
+    end
     chunked_p = chunked?
 
     buf = +''

test/net/http/test_http.rb

@@ -933,13 +933,14 @@ def test_set_form_with_file
   end
 
   def test_set_form_multipart_crlf_injection
-    build = ->(data) {
+    build = ->(data, opt = {}) {
       req = Net::HTTP::Post.new('/')
       req.set_form(data, 'multipart/form-data')
       out = +''
-      req.send(:encode_multipart_form_data, out, req.instance_variable_get(:@body_data), {})
+      req.send(:encode_multipart_form_data, out, req.instance_variable_get(:@body_data), opt)
     }
     assert_raise(ArgumentError) { build.call([["foo\r\nX-Injected: 1", 'v']]) }
+    assert_raise(ArgumentError) { build.call([['f', 'v']], boundary: "abc\r\nX-Injected: 1") }
     assert_raise(ArgumentError) { build.call([['f', 'v', {filename: "a\r\nX-Injected: 1"}]]) }
     assert_raise(ArgumentError) do
       build.call([['f', 'v', {filename: 'a', content_type: "text/plain\r\nX-Injected: 1"}]])