How to fix “Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')”

Question

After running VeraCode, it reported a following error \"Improper Neutralization of CRLF Sequences in HTTP Headers (\'HTTP Response Splitting\')\" in the following code fragm

Answer 1

I believe the problem is because the line

languageCookie.Value = Server.UrlDecode(Request.QueryString["l"]);

accepts (untrusted) user input (i.e. Request.QueryString["l"]). Try adding a function call to remove any carriage returns or line feed characters (including their encoded equivalents like %0d and %0a) from that query string parameter before storing it in languageCookie.

For example, you might try changing that line to:

languageCookie.Value = Server.UrlDecode(Request.QueryString["l"])
                         .Replace("\r", string.Empty)
                         .Replace("%0d", string.Empty)
                         .Replace("%0D", string.Empty)
                         .Replace("\n", string.Empty)
                         .Replace("%0a", string.Empty)
                         .Replace("%0A", string.Empty);

though that should probably be cleaned up a bit (I'm not a C# programmer at this time).

See also

• http://en.wikipedia.org/wiki/HTTP_response_splitting
• http://www.securiteam.com/securityreviews/5WP0E2KFGK.html
• https://www.owasp.org/index.php/Testing_for_HTTP_Splitting/Smuggling_(OWASP-DV-016)