Active attacks can inject into header names
### Purpose Injection locations should be created for header names in a request. ### Example A request with the following head: ``` GET /page/1 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE5.01; Windows NT) Host: www.gitlab.com Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: Keep-Alive ``` Five injection locations should be created, one for `User-Agent`, `Host`, `Accept-Language`, `Accept-Encoding`, and `Connection`. The injection location should replace the name of the header, not the value.
issue