Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Prevent HTTP response splitting #3938

Closed
wants to merge 1 commit into from
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
Prevent HTTP response splitting
Evaluate if http header value contains CR/LF.

Reference: https://www.owasp.org/index.php/HTTP_Response_Splitting

Fixes gh-3910
  • Loading branch information
eddumelendez committed Jun 21, 2016
commit 302dede75e8af5e920f637926a3283cf8be289bf
Expand Up @@ -22,8 +22,10 @@

/**
* @author Luke Taylor
* @author Eddú Meléndez
*/
class FirewalledResponse extends HttpServletResponseWrapper {

private static final Pattern CR_OR_LF = Pattern.compile("\\r|\\n");

public FirewalledResponse(HttpServletResponse response) {
Expand All @@ -34,10 +36,27 @@ public FirewalledResponse(HttpServletResponse response) {
public void sendRedirect(String location) throws IOException {
// TODO: implement pluggable validation, instead of simple blacklisting.
// SEC-1790. Prevent redirects containing CRLF
if (CR_OR_LF.matcher(location).find()) {
validateCRLF("Location", location);
super.sendRedirect(location);
}

@Override
public void setHeader(String name, String value) {
validateCRLF(name, value);
super.setHeader(name, value);
}

@Override
public void addHeader(String name, String value) {
validateCRLF(name, value);
super.addHeader(name, value);
}

private void validateCRLF(String name, String value) {
if (CR_OR_LF.matcher(value).find()) {
throw new IllegalArgumentException(
"Invalid characters (CR/LF) in redirect location");
"Invalid characters (CR/LF) in header " + name);
}
super.sendRedirect(location);
}

}
Expand Up @@ -15,19 +15,21 @@
*/
package org.springframework.security.web.firewall;

import static org.assertj.core.api.Assertions.assertThat;
import static org.assertj.core.api.Assertions.fail;
import org.junit.Test;

import org.junit.*;
import org.springframework.mock.web.MockHttpServletResponse;

import static org.assertj.core.api.Assertions.assertThat;
import static org.assertj.core.api.Assertions.fail;

/**
* @author Luke Taylor
* @author Eddú Meléndez
*/
public class FirewalledResponseTests {

@Test
public void rejectsRedirectLocationContaingCRLF() throws Exception {
public void rejectsRedirectLocationContainingCRLF() throws Exception {
MockHttpServletResponse response = new MockHttpServletResponse();
FirewalledResponse fwResponse = new FirewalledResponse(response);

Expand All @@ -54,4 +56,24 @@ public void rejectsRedirectLocationContaingCRLF() throws Exception {
catch (IllegalArgumentException expected) {
}
}

@Test
public void rejectHeaderContainingCRLF() {
MockHttpServletResponse response = new MockHttpServletResponse();
FirewalledResponse fwResponse = new FirewalledResponse(response);

try {
fwResponse.addHeader("foo", "abc\r\nContent-Length:100");
fail("IllegalArgumentException should have thrown");
}
catch (IllegalArgumentException expected) {
}
try {
fwResponse.setHeader("foo", "abc\r\nContent-Length:100");
fail("IllegalArgumentException should have thrown");
}
catch (IllegalArgumentException expected) {
}
}

}