Prevent header injection through malformed response reason phrase

[Jake Howard]

HttpResponse.reason_phrase is not correctly sanitized when creating a response body:

HttpResponse(
    "body",
    reason="OK\r\nX-Injected-header: yes",
)

This results in an extra header in the response, which is not present in .headers.

The ​WSGI spec requires that the status line (which contains the reason phrase) must not contain whitespace or other control characters. Therefore, Django should sanitize the input.

---

This was previously reported to the Security Team by rasputinkaiser, however as reason phase is never intended to be user-controlled, it was not considered a vulnerability.

[Varun Kasyap Pentamaraju]

​https://github.com/django/django/pull/21290

[Jacob Walls <jacobtylerwalls@…>]

In 5364575:

Fixed #37100 -- Prevented control characters in HttpResponse reason_phrase.

[Jacob Walls <jacobtylerwalls@…>]

In d7b3fed:

[6.1.x] Fixed #37100 -- Prevented control characters in HttpResponse reason_phrase.

Backport of 53645750412efa1e9013004040db328bd515e0f1 from main.