Spaces are ok; CRs and LFs are not

Protect against HTTP response splitting* without
overzealously blocking standard space characters
from URLs

* see http://en.wikipedia.org/wiki/HTTP_response_splitting

r2/r2/lib/base.py

@@ -176,8 +176,8 @@ class BaseController(WSGIController):
 
         # unparse and encode it un utf8
         rv = _force_unicode(u.unparse()).encode('utf8')
-        if any(ch.isspace() for ch in rv):
-            raise ValueError("Space characters in redirect URL: [%r]" % rv)
+        if "\n" in rv or "\r" in rv:
+            abort(400)
         return rv