APrieto034095 (Community Member) asked a question.
CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers
Hi,
I got a CWE-133 on the following piece of code:
Cookie cookie = new Cookie(key, value);
if (this.m_strictServletCompliance) {
cookie.setSecure(true);
if (!path.endsWith("/")) {
path = path + '/';
}
}
Does not a "/" at the end of the path fix that issue?
Regards
.png){kind=logo}
Hi @APrieto034095 (Community Member),
Thanks for your question. CWE-113 is relating to the lack of cleansing of CR (carriage return) and LF (line feed) characters before the data is included in outgoing HTTP headers. The code snipped you included does not appear to set any HTTP headers. I recommend reviewing the flaw within the Triage Flaws section of the Veracode Platform for the scan in question. This will allow you to select a file to upload into your browser so you can pinpoint the exact line the flaw was found on, furthermore the attack vector, description and remediation text should be read which contains a wealth of information about where the flaw was found and how to resolve it.
To resolve CWE-113 I recommend you use a supported cleansing function that is appropriate everywhere you output HTTP headers that are constructed from untrusted data. You can find our supported cleansing functions here: https://help.veracode.com/reader/4EKhlLSMHm5jC8P8j3XccQ/IiF_rOE79ANbwnZwreSPGA.
I hope that helps.
Thanks,
Anthony Fielding