tool_getparam: reject argument to options using CRLF

Unless explcitly allowed, like for -w. To reduce the risk that users get
funny and unexpected results.

Verify in test 2016

src/tool_getparam.c

@@ -369,7 +369,7 @@ static const struct LongShort aliases[] = {
 #ifdef USE_WATT32
   {"wdebug",                     ARG_BOOL, ' ', C_WDEBUG},
 #endif
-  {"write-out",                  ARG_STRG, 'w', C_WRITE_OUT},
+  {"write-out",                  ARG_STRG|ARG_CRLF, 'w', C_WRITE_OUT},
   {"xattr",                      ARG_BOOL, ' ', C_XATTR},
 };
 
@@ -2899,6 +2899,16 @@ static bool has_leading_unicode(const unsigned char *arg)
   return (arg[0] == 0xe2) && (arg[1] == 0x80) && (arg[2] & 0x80);
 }
 
+static bool has_crlf(const char *arg)
+{
+  while(*arg) {
+    if(ISNEWLINE(*arg))
+      return TRUE;
+    arg++;
+  }
+  return FALSE;
+}
+
 /* the longest command line option, excluding the leading -- */
 #define MAX_OPTION_LEN 26
 
@@ -3034,6 +3044,11 @@ ParameterError getparameter(const char *flag, /* f or -long-flag */
         break;
       }
 
+      if(!(a->desc & ARG_CRLF) && has_crlf(nextarg)) {
+        errorf("Argument contains CR or LF");
+        err = PARAM_BAD_USE;
+        break;
+      }
       if(has_leading_unicode((const unsigned char *)nextarg)) {
         warnf("The argument '%s' starts with a Unicode character. "
               "Maybe ASCII was intended?", nextarg);

src/tool_getparam.h

@@ -324,6 +324,7 @@ typedef enum {
 #define ARG_TYPEMASK 0x07
 #define ARGTYPE(x)   ((x) & ARG_TYPEMASK)
 
+#define ARG_CRLF  0x08 /* allow CR and LF in argument */
 #define ARG_DEPR  0x10 /* deprecated option */
 #define ARG_CLEAR 0x20 /* clear cmdline argument */
 #define ARG_TLS   0x40 /* requires TLS support */

tests/data/Makefile.am

@@ -242,7 +242,7 @@ test1979 test1980 test1981 test1982 test1983 test1984 \
 \
 test2000 test2001 test2002 test2003 test2004 test2005 test2006 test2007 \
 test2008 test2009 test2010 test2011 test2012 test2013 test2014 test2015 \
-\
+test2016 \
                                                                test2023 \
 test2024 test2025 test2026 test2027 test2028 test2029 test2030 test2031 \
 test2032 test2033 test2034 test2035 test2036 test2037 test2038 test2039 \

tests/data/test2016

@@ -0,0 +1,32 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTP
+</keywords>
+</info>
+
+# Server-side
+<reply>
+</reply>
+
+# Client-side
+<client>
+<server>
+http
+</server>
+<name>
+Attempt sending a carriage return in a HTTP header
+</name>
+<command>
+http://%HOSTIP:%HTTPPORT/%TESTNUMBER -H 'A: %CR'
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<errorcode>
+2
+</errorcode>
+</verify>
+</testcase>