Hi,

Veracode Static Analysis reports CWE 113 on HTTP Cookies when it can see that input from a possibly user controlled source of data is going into the cookie values. The concern is that if an attacker is able to inject a CR LF (\r\n) they may be able to affect the headers set out of your application.

Typically, we recommend use of one of our Supported Cleansing Functions ( https://docs.veracode.com/r/Supported_Java_Cleansing_Functions ). An example function would be java.net.URLEncoder.encode .

However, the way that Veracode Static Analysis detects this flaw we recommend you **always create a new cookie**.

Veracode Static Analysis is unable to automatically close the flaw if it sees the same original cookie is used.

For example:

@GetMapping("/index")

public void test(HttpServletRequest request, HttpServletResponse response) {

Cookie oldCookie = getCookie(request, "login");

oldCookie.setValue(URLEncoder.encode(oldCookie.getValue()));

response.addCookie(oldCookie);

}

public static Cookie getCookie(HttpServletRequest request, String name) {

Cookie[] cookies = request.getCookies();

if (cookies != null) {

for (Cookie cookie : cookies) {

if (cookie.getName().equals(name)) {

return cookie;

}

}

}

return null;

}

Here " response.addCookie(oldCookie);" would still be reported as Veracode Static Analysis sees the old cookie used.

When you use a new cookie Veracode Static Analysis will automatically be able to close the flaw:

@GetMapping("/index")

public void fixed(HttpServletRequest request, HttpServletResponse response) {

Cookie oldCookie = getCookie(request, "login");

Cookie newCookie = new Cookie("login", URLEncoder.encode(oldCookie.getValue()));

newCookie.setSecure(true);

newCookie.setHttpOnly(true);

response.addCookie(newCookie);

}

Thank you,

Boy Baukema