CVE-2019-16785: HTTP Request Smuggling: LF vs CRLF handling in Waitress

Waitress implemented a "MAY" part of the RFC7230 (https://tools.ietf.org/html/rfc7230#section-3.5) which states:

Although the line terminator for the start-line and header fields is the sequence CRLF, a recipient MAY recognize a single LF as a line terminator and ignore any preceding CR.

Unfortunately if a front-end server does not parse header fields with an LF the same way as it does those with a CRLF it can lead to the front-end and the back-end server parsing the same HTTP message in two different ways. This can lead to a potential for HTTP request smuggling/splitting whereby Waitress may see two requests while the front-end server only sees a single HTTP message.

Example:

Content-Length: 100[CRLF]
X-Header: x[LF]Content-Length: 0[CRLF]

Would get treated by Waitress as if it were:

Content-Length: 100
X-Header: x
Content-Length: 0

This could potentially get used by attackers to split the HTTP request and smuggle a second request in the body of the first.