Avoid validating twice parsed header values.

Fix #1714.

Author: aaugustin

src/websockets/datastructures.py

@@ -165,6 +165,16 @@ def raw_items(self) -> Iterator[tuple[str, str]]:
         """
         return iter(self._list)
 
+    # Internal menthods
+
+    def set_insecure(self, key: str, value: str) -> None:
+        """
+        Set a header without validating its value.
+
+        """
+        self._dict.setdefault(key.lower(), []).append(value)
+        self._list.append((key, value))
+
 
 # copy of _typeshed.SupportsKeysAndGetItem.
 class SupportsKeysAndGetItem(Protocol):  # pragma: no cover

src/websockets/http11.py

@@ -369,7 +369,9 @@ def parse_headers(
 
         name = raw_name.decode("ascii")  # guaranteed to be ASCII at this point
         value = raw_value.decode("ascii", "surrogateescape")
-        headers[name] = value
+
+        # Since we just validated raw_value, we don't need to revalidate it.
+        headers.set_insecure(name, value)
 
     else:
         raise SecurityError("too many HTTP headers")

tests/test_datastructures.py

@@ -173,6 +173,14 @@ def test_raw_items(self):
             [("Connection", "Upgrade"), ("Server", "websockets")],
         )
 
+    def test_set_insecure(self):
+        self.headers.set_insecure("Upgrade", "websocket")
+        self.assertEqual(self.headers["Upgrade"], "websocket")
+
+    def test_set_insecure_invalid_value(self):
+        self.headers.set_insecure("X-Invalid", "multi\r\nline")
+        self.assertEqual(self.headers["X-Invalid"], "multi\r\nline")  # oops
+
 
 class MultiValueHeadersTests(unittest.TestCase):
     def setUp(self):