Prevent HTTP response splitting

[eddumelendez]

Evaluate if http header value contains CR/LF.

Reference: https://www.owasp.org/index.php/HTTP_Response_Splitting

Fixes gh-3910

[pivotal-issuemaster]

@eddumelendez Thank you for signing the Contributor License Agreement!

[rwinch]

Is there a reason you made the change here? I think the best place for the change is in FirewalledResponse. You would override both setHeader and addHeader methods of HttpServletResponseWrapper

[eddumelendez]

@rwinch PR updated

[rwinch]

@eddumelendez Thanks for the fast response. I had something like this in mind:

You would override both setHeader and addHeader methods of HttpServletResponseWrapper

@Override
public void setHeader(String name, String value) {
    if (CR_OR_LF.matcher(value).find()) {
        throw new IllegalArgumentException(
                "Invalid characters (CR/LF) in header");
    }
    super.setHeader(name, value);
}

@Override
public void addHeader(String name, String value) {
    if (CR_OR_LF.matcher(value).find()) {
        throw new IllegalArgumentException(
                "Invalid characters (CR/LF) in header");
    }
    super.addHeader(name, value);
}

You might even extract out the validation logic.

[eddumelendez]

@rwinch Thanks for the hint. PR updated.

[rwinch]

We need a different error message since these are not redirect locations. You could probably just change this to header since redirect location is a header.

[eddumelendez]

@rwinch PR updated. I am also printing the header in the exception message.

[rwinch]

Thanks for the PR! This is merged via 26fa4a4