THirsch156079 (Community Member) asked a question.

June 29, 2020 at 10:01 AM
Hello all, i have one question to the flaw "Improper Neutralization of CRLF Sequences ('CRLF Injection') (CWE ID 93)".

Here is my code snippset, in which i get the flaw CWE ID 93:

 

msg.setReplyTo(new javax.mail.Address[] {new InternetAddress(Encode.forJava(email.getReplyTo()))});

 

I read that the Encoder "org.owasp.encoder.Encode" should solve the flaw. But it didn't.

 

Have anyone another idea to write the code CRLF sure for the Veracode Scanner?

 

Many thank.

Tassilo

  • 1 answer
  • 2.13K views

  • Boy, Security Consultant (Veracode)

    Hi @THirsch156079 (Community Member)​ ,

     

    Encode.forJava is a supported cleansing function in Java for CWE 93 ( for a full overview see: https://help.veracode.com/reader/4EKhlLSMHm5jC8P8j3XccQ/IiF_rOE79ANbwnZwreSPGA ).

    If this is not recognized automatically I would recommend you contact our technical support team. Here's how you can log a case:

    1. Navigate to the upper right corner of any page in the Community, click on your user avatar.

    2. Select Contact Support from the drop-down menu.

     

    In your support case please ensure you mention:

    1. The issue
    2. URL to your results in the Veracode Platform (preferably Triage Flaws view).
    3. Specific flaw id in question.

     

    Thank you,

    Boy Baukema

    Expand Post

Topics (3)

No articles found
Loading

Ask the Community

Get answers, share a use case, discuss your favorite features, or get input from the community.