fix(oss-licenses-plugin): sanitize newlines in Dependency.name to prevent metadata injection

oss-licenses-plugin/src/main/groovy/com/google/android/gms/oss/licenses/plugin/LicensesTask.groovy

@@ -352,12 +352,14 @@ abstract class LicensesTask extends DefaultTask {
     }
 
     protected static class Dependency {
-        String key
-        String name
+        final String key
+        final String name
 
         Dependency(String key, String name) {
-            this.key = key
-            this.name = name
+            this.key = Objects.requireNonNull(key, "key cannot be null")
+            this.name = Objects.requireNonNull(name, "name cannot be null")
+                    .replaceAll(/\R+/, ' ')
+                    .strip()
         }
 
         String buildLicensesMetadata(String offset) {

oss-licenses-plugin/src/test/java/com/google/android/gms/oss/licenses/plugin/LicensesTaskTest.java

@@ -447,6 +447,27 @@ public void testWriteMetadata() throws IOException {
     assertEquals(expected, content);
   }
 
+  @Test
+  public void testWriteMetadata_sanitizesNewlinesInName() throws IOException {
+    licensesTask.initOutputDir();
+    licensesTask.appendDependency(
+        new LicensesTask.Dependency("test:foo", "Dependency 1\n0:120 Forged Entry"),
+        "licenseA".getBytes(UTF_8));
+    licensesTask.appendDependency(
+        new LicensesTask.Dependency("test:bar", "\r\nDependency 2\r\nSpoofed\r\n"),
+        "licenseB".getBytes(UTF_8));
+    licensesTask.writeMetadata();
+
+    String expected =
+        "0:8 Dependency 1 0:120 Forged Entry"
+            + LINE_BREAK
+            + "9:8 Dependency 2 Spoofed"
+            + LINE_BREAK;
+    String content =
+        new String(Files.readAllBytes(licensesTask.getLicensesMetadata().toPath()), UTF_8);
+    assertEquals(expected, content);
+  }
+
   @Test
   public void testDependenciesWithNameDuplicatedNames() throws IOException {
     File deps6 = getResourceFile("dependencies/groupF/deps6.pom");