Solutions Library

Java detectors (12/12)

HTTP response splitting

HTTP response splitting

Critical
Passing data from an untrusted source into a cookie or web response might expose the user to HTTP response splitting attacks. An attacker might send manipulated requests that could inject code into a cookie or the body of the response.
Detector ID
java/http-response-splitting@v1.0
Category
Security
Tags
  • cookies
  • injection
  • owasp-top10
Common Weakness Enumeration (CWE) 

Noncompliant example

  public void headerSplittingProtectionDisabledNoncompliant() {
    // Noncompliant: false argument disables header validation.
    final DefaultHttpHeaders headers = new DefaultHttpHeaders(false);
    headers.clear();
  }

Noncompliant example

  public void addToCookieWithoutSanitizationNoncompliant(HttpServletRequest request, HttpServletResponse response) {
    final String name = request.getParameter("name");
    // Noncompliant: parameter added to cookie might contain special chars.
    Cookie cookie = new Cookie("name", name);
    cookie.setSecure(true);
    response.addCookie(cookie);
}

Compliant example

  public void headerSplittingProtectionEnabledCompliant() {
    // Compliant: header validation is enabled by default.
    final DefaultHttpHeaders headers = new DefaultHttpHeaders();
    headers.clear();
    // Compliant: header validation is enabled explicitly.
    final DefaultHttpHeaders moreHeaders = new DefaultHttpHeaders(true);
    moreHeaders.clear();
  }

Compliant example

  public void addToCookieWithSanitizationCompliant(HttpServletRequest request, HttpServletResponse response) {
    // Compliant: parameter sanitized before adding to cookie.
    final String name = request.getParameter("name").replaceAll("[^a-zA-Z ]", "");
    Cookie cookie = new Cookie("name", name);
    cookie.setSecure(true);
    response.addCookie(cookie);
  }