Introduced protections against HTTP header injection / smuggling attacks

[pixeebot]

This change ensures that HTTP response header values can't contain newline characters, leaving you vulnerable to HTTP response splitting and other attacks.

If malicious users can get newline characters into an HTTP response header, they can inject and forge new header values that look like they came from the server, and trick web gateways, proxies, and browsers. This leads to vulnerabilities like Cross-site Scripting (XSS), HTTP response splitting, and more attacks from there.

Our change simply makes sure that if the string passed to be a new response header value is non-null, all the newline characters (CR and LF) will be removed:

+ import io.github.pixee.security.Newlines;
  ...
  String orderId = getUserOrderId();
- response.setHeader("X-Acme-Order-ID", orderId);
+ response.setHeader("X-Acme-Order-ID", Newlines.stripAll(orderId));

Note: Many modern application servers will sanitize these values, but it's almost never specified in documentation, and thus there is little guarantee against regression. Given that, we still recommend this practice.

More reading

• https://www.netsparker.com/blog/web-security/crlf-http-header/
• https://owasp.org/www-community/attacks/HTTP_Response_Splitting
• https://regilero.github.io/security/english/2015/10/04/http_smuggling_in_2015_part_one/

I have additional improvements ready for this repo! If you want to see them, leave the comment:

@pixeebot next

... and I will open a new PR right away!

🧚🤖 Powered by Pixeebot

Feedback | Community | Docs | Codemod ID: pixee:java/strip-http-header-newlines

[pixeebot]

This library holds security tools for protecting Java API calls.

License: MIT ✅ | Open source ✅ | More facts

[pixeebot]

This library holds security tools for protecting Java API calls.

License: MIT ✅ | Open source ✅ | More facts

[pixeebot]

I'm confident in this change, but I'm not a maintainer of this project. Do you see any reason not to merge it?

If this change was not helpful, or you have suggestions for improvements, please let me know!

[pixeebot]

Unless you want to allow metacharacters that could, in some situations, drive unexpected behavior -- we recommend merging this change. The drop-in solution provided doesn't change anything besides removing newlines in the outgoing header value.

If there are other concerns about this change, I'd love to hear about them!

[pixeebot]

This change may not be a priority right now, so I'll close it. If there was something I could have done better, please let me know!

You can also customize me to make sure I'm working with you in the way you want.