Limit header name in HtppListenerRequest

[iremyux]

Fixes #132128

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).
13 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[dotnet-policy-service]

Tagging subscribers to this area: @karelz, @dotnet/ncl
See info in area-owners.md if you want to be subscribed.

[Copilot]

Pull request overview

This PR tightens request header parsing in the managed HttpListener implementation to reject malformed header field names that include leading whitespace or whitespace before the : separator, aligning behavior with HTTP requirements while preserving optional whitespace trimming around header values.

Changes:

• Reject request headers whose field-name contains ASCII space or tab before the colon in the managed HttpListener request parser.
• Stop trimming the header name (field-name) during parsing; continue trimming only ASCII space/tab around the field-value.
• Add managed-implementation-only regression coverage for malformed header names with leading whitespace or whitespace before :.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
src/libraries/System.Net.HttpListener/tests/InvalidClientRequestTests.cs	Adds managed-only invalid request cases for header names with leading whitespace or whitespace before the colon.
src/libraries/System.Net.HttpListener/src/System/Net/Managed/HttpListenerRequest.Managed.cs	Updates managed header parsing to validate field-name without trimming and reject space/tab in the name portion; trims only SP/HTAB around values.

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).
13 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (1)

src/libraries/System.Net.HttpListener/src/System/Net/Managed/HttpListenerRequest.Managed.cs:212

• s_validMethodChars is now used to validate both the HTTP method token and the header field-name token. The character set is correct for both, but the name has become misleading and makes it harder to understand why method-validation logic is being reused for header parsing. Consider renaming it to something like s_validTokenChars (and updating both call sites) to match its broader purpose.

            int colon = header.IndexOf(':');
            if (colon <= 0 || header.AsSpan(0, colon).ContainsAnyExcept(s_validMethodChars))
            {

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.