RPOLANI831351 (Community Member) asked a question.
Improper Neutralization of CRLF Sequences ('CRLF Injection') (CWE ID 93)
I have used Encoder "org.owasp.encoder.Encode" to solve this issue in my java application code.
by using Encode.forJava(String) method and it was working fine till May 2020
But during my recent scan on July 2020, issue is reopened.
Can you suggest any other idea to fix this issue.
.png){kind=logo}
Hi @RPOLANI831351 (Community Member),
Thanks for your question. org.owasp.encoder.Encode.forJava is a supported cleanser (https://help.veracode.com/reader/4EKhlLSMHm5jC8P8j3XccQ/IiF_rOE79ANbwnZwreSPGA) for CWE-93 and when used correctly should result in the flaw not being presented. Could it be that there is another parameter or some other component of that which has not passed through this cleanser? I would recommend reading the Attack Vector and Description details for the flaw in the Triage Flaws page to get an idea where exactly the flaw was found.
I recommend scheduling a consultation with a Veracode Application Security Consultant if you would like to discuss this specific flaw. You can find details on how to schedule a consultation here: https://help.veracode.com/reader/DGHxSJy3Gn3gtuSIN2jkRQ/7YQTCDJKFEQzL3gL_N90hQ.
I hope that was useful to you.
Many thanks,
Anthony Fielding