fix(falcon): validate response header encodings while preserving Latin-1 values

[mvanhorn]

Summary of Changes

The three setters now validate through _prepare_header: the name must pass isascii() before it is lowercased, the value is still coerced with str(), and a non-ASCII value must encode as Latin-1 or the helper raises ValueError. The method docs and the bugfix note describe that contract, including that the check covers encoding and leaves ASCII control characters and HTTP field syntax to the application and the server, and that set_headers keeps items already written when a later item fails. ASGI encodes extra-header names as ASCII and their values as Latin-1, and a Latin-1 failure while rendering headers now reports ISO-8859-1. The tests cover setter acceptance and rejection, partial set_headers updates, Latin-1 emission on WSGI and ASGI, and the render path for content_type, which does not go through the setters.

Response.set_header, append_header, and set_headers stored header names that are not US-ASCII, including characters that change under lowercasing, and stored values that cannot be encoded as Latin-1. On ASGI, a Latin-1 value in an extra header such as Set-Cookie then failed while the headers were encoded, and the error said that names and values must be ASCII. Those setters only applied str() to the value and lowercased the name. str() returns an existing string unchanged, so it never checked an encoding, and case folding happened before any check of the name. Ordinary ASGI headers were encoded as Latin-1, but each _extra_headers value was encoded with ascii, and the UnicodeEncodeError handler described that failure as an ASCII-only rule.

Related Issues

Fixes #2767

Pull Request Checklist

This is just a reminder about the most common mistakes. Please make sure that you tick all appropriate boxes. Reading our contribution guide at least once will save you a few review cycles!

If an item doesn't apply to your pull request, check it anyway to make it apparent that there's nothing to do.

• Applied changes to both WSGI and ASGI code paths and interfaces (where applicable).
• Added tests for changed code.
• Performed automated tests and code quality checks by running tox.
  Not claimed: tox was not run locally for falcon/asgi/response.py and falcon/response.py.
• Prefixed code comments with GitHub nick and an appropriate prefix.
• Coding style is consistent with the rest of the framework.
• Updated documentation for changed code.
  • Added docstrings for any new classes, functions, or modules.
    Left unticked: nothing in this change to falcon/asgi/response.py and falcon/response.py backs it.
  • Updated docstrings for any modifications to existing code.
    Left unticked: nothing in this change to falcon/asgi/response.py and falcon/response.py backs it.
  • Updated both WSGI and ASGI docs (where applicable).
  • Added references to new classes, functions, or modules to the relevant RST file under docs/.
    Not claimed: the local test run for falcon/asgi/response.py and falcon/response.py could not complete in this environment.
  • Updated all relevant supporting documentation files under docs/.
    Not claimed: docs/ was not run locally either.
  • A copyright notice is included at the top of any new modules (using your own name or the name of your organization).
  • Changed/added classes/methods/functions have appropriate versionadded, versionchanged, or deprecated directives.
    Not claimed: versionadded was not run locally either.
• Changes (and possible deprecations) have towncrier news fragments under docs/_newsfragments/, with the file name format {issue_number}.{fragment_type}.rst. (Run tox -e docs, and inspect docs/_build/html/changes/ in the browser to ensure it renders correctly.)
  Not claimed: this diff changes no changelog or release-note file.
• LLM output, if any, has been carefully reviewed and tested by a human developer. (See also: Use of LLMs ("AI").)
  Not claimed: the same reason as the box above applies.

If you have any questions to any of the points above, just submit and ask! This checklist is here to help you, not to deter you from contributing!

PR template inspired by the attrs project.

AI was used for assistance.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (05b35ee) to head (c543c84).

Additional details and impacted files

@@            Coverage Diff            @@
##            master     #2768   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files           64        64           
  Lines         8099      8107    +8     
  Branches      1131      1133    +2     
=========================================
+ Hits          8099      8107    +8     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[vytas7]

I'm sorry, but we cannot accept LLM-generated code changes from you because you cannot verify them.