Merge pull request #105 from pinterest/security-sanitize

Security sanitize key 

2 files changed, 7 insertions, 1 deletions

diff --git a/pymemcache/client/base.py b/pymemcache/client/base.py
index 75793bb..ade1a18 100644
--- a/pymemcache/client/base.py
+++ b/pymemcache/client/base.py
@@ -72,7 +72,7 @@ def _check_key(key, key_prefix=b''):
         except UnicodeEncodeError:
             raise MemcacheIllegalInputError("No ascii key: %r" % (key,))
     key = key_prefix + key
-    if b' ' in key:
+    if b' ' in key or b'\n' in key:
         raise MemcacheIllegalInputError("Key contains spaces: %r" % (key,))
     if len(key) > 250:
         raise MemcacheIllegalInputError("Key is too long: %r" % (key,))
diff --git a/pymemcache/test/test_integration.py b/pymemcache/test/test_integration.py
index 491512a..17b26fd 100644
--- a/pymemcache/test/test_integration.py
+++ b/pymemcache/test/test_integration.py
@@ -220,6 +220,12 @@ def test_errors(client_class, host, port, socket_module):
     with pytest.raises(MemcacheIllegalInputError):
         _key_with_ws()
 
+    def _key_with_illegal_carriage_return():
+        client.set(b'\r\nflush_all', b'value', noreply=False)
+
+    with pytest.raises(MemcacheIllegalInputError):
+        _key_with_illegal_carriage_return()
+
     def _key_too_long():
         client.set(b'x' * 1024, b'value', noreply=False)