> "The attack is trivial to prevent; just don't allow newlines (and, ideally, active HTML characters) in redirect content."

Surely the more correct solution is to escape them properly.

eg in the example:

  Location: javascript:
 
  <script>alert(document.cookie)</script>

occurs because something unescaped the %0D%0A%0D%0A. If however you just leave it as it was originally, or alternatively encode it properly after you've decoded it.

  Location: javascript:%0D%0A%0D%0A<script>alert(document.cookie)</script>

and everything works as it should.