[Storage] Blob Batch Inner-Header CRLF Injection Bugfix

[Isabelle (ibrandes)]

Reject CR/LF in Blob Batch inner request headers (header-injection fix)

Summary

The Blob Batch client serializes each inner application/http request's headers by concatenating the header name and value directly into the multipart batch body, without rejecting carriage-return (\r) or line-feed (\n) characters. Because these inner headers are emitted as bytes inside the outer request body, the HTTP transport layer never validates them. A caller-controlled header value — for example a blob tag condition supplied through the public BlobRequestConditions.setTagsConditions(...) API — could therefore terminate the intended x-ms-if-tags header and inject an additional Azure Storage operation-control header such as x-ms-delete-snapshots.

This PR adds validation at the final inner-header serialization boundary in BlobBatchOperationInfo.addBatchOperation that rejects (rather than strips or normalizes) any \r or \n in inner header names and values, throwing IllegalArgumentException. Rejecting preserves the semantics of the authorized request so it cannot silently acquire a different meaning. Clean headers are unaffected.

The non-batch delete path already rejects the same CRLF-bearing value before it reaches the network; this brings the Blob Batch path in line with that behavior.

Changes

• BlobBatchOperationInfo.java — added a validateHeader(...) check applied to each inner header name/value before serialization; added a ClientLogger for exception logging.
• BlobBatchHeaderInjectionTests.java — new regression tests (extending BlobBatchTestBase) covering CRLF, lone CR, lone LF (all rejected) and a clean control (preserved). Tests run fully offline via prepareBlobBatchSubmission(), which builds the batch body without a network call.
• CHANGELOG.md — added a "Bugs Fixed" entry under 12.32.0-beta.2 (Unreleased).

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
34 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

🟡 Changes recommended

Security-sensitive header-name validation lacks regression coverage.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Adds CR/LF validation at Blob Batch inner-header serialization to prevent header injection.

Changes:

• Rejects CR/LF in inner header names and values.
• Adds regression tests and changelog documentation.

File summaries

File	Description
BlobBatchOperationInfo.java	Validates headers before serialization.
BlobBatchHeaderInjectionTests.java	Tests malicious values and clean serialization.
CHANGELOG.md	Documents the security fix.

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 1
• Review effort level: Balanced

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟢 Approval recommended

The serialization-boundary validation comprehensively addresses the vulnerability and is backed by focused regression coverage.

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 0 new
• Review effort level: Balanced

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
34 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.