chromium/third_party/blink/web_tests/http/tests/xmlhttprequest/newline-in-request-uri.html

<p>Test for <a href="https://bugs.webkit.org/show_bug.cgi?id=22731">bug 22731</a>:
Newline in XMLHttpRequest URL can be used to remove HTTP headers (e.g. Host:).</p>
<pre id="lf">LF FAIL: test did not run</pre>
<pre id="cr">CR FAIL: test did not run</pre>
<script>
if (window.testRunner)
    testRunner.dumpAsText();

var req = new XMLHttpRequest;
req.open("GET", "http://127.0.0.1:8000/xmlhttprequest/resources/print-headers.cgi\n", false);
req.send(null);
if (req.responseText.match(/HTTP_HOST: 127.0.0.1:8000/))
    document.getElementById("lf").innerHTML = "LF SUCCESS";
else
    document.getElementById("lf").innerHTML = "LF FAIL. Headers are:\n" + req.responseText;

req.open("GET", "http://127.0.0.1:8000/xmlhttprequest/resources/print-headers.cgi\r", false);
req.send(null);
if (req.responseText.match(/HTTP_HOST: 127.0.0.1:8000/))
    document.getElementById("cr").innerHTML = "CR SUCCESS";
else
    document.getElementById("cr").innerHTML = "CR FAIL. Headers are:\n" + req.responseText;
</script>