Introduced protections against HTTP header injection / smuggling attacks

[pixeebot]

This change ensures that HTTP response header values can't contain newline characters, leaving you vulnerable to HTTP response splitting and other attacks.

If malicious users can get newline characters into an HTTP response header, they can inject and forge new header values that look like they came from the server, and trick web gateways, proxies, and browsers. This leads to vulnerabilities like Cross-site Scripting (XSS), HTTP response splitting, and more attacks from there.

Our change simply makes sure that if the string passed to be a new response header value is non-null, all the newline characters (CR and LF) will be removed:

+ import io.github.pixee.security.Newlines;
  ...
  String orderId = getUserOrderId();
- response.setHeader("X-Acme-Order-ID", orderId);
+ response.setHeader("X-Acme-Order-ID", Newlines.stripAll(orderId));

Note: Many modern application servers will sanitize these values, but it's almost never specified in documentation, and thus there is little guarantee against regression. Given that, we still recommend this practice.

❌ The following packages couldn't be installed automatically, probably because the dependency manager is unsupported. Please install them manually:

Gradle

dependencies {
  implementation("io.github.pixee:java-security-toolkit:1.1.3")
}

Maven

<dependencies>
  <dependency>
    <groupId>io.github.pixee</groupId>
    <artifactId>java-security-toolkit</artifactId>
    <version>1.1.3</version>
  </dependency>
<dependencies>

More reading

• https://www.netsparker.com/blog/web-security/crlf-http-header/
• https://owasp.org/www-community/attacks/HTTP_Response_Splitting
• https://regilero.github.io/security/english/2015/10/04/http_smuggling_in_2015_part_one/

I have additional improvements ready for this repo! If you want to see them, leave the comment:

@pixeebot next

... and I will open a new PR right away!

Powered by: pixeebot (codemod ID: pixee:java/strip-http-header-newlines)

[neroux]

Adding a whole new library is more dangerous than any of the code lines pointed out.

Most of them are numeric values, which by definition cannot contain line breaks. This pull request actually seems to have addressed mostly the server part, which would not protect client implementations. For this it is better to run a String.replace() call in HttpBase._headerRaw() instead.

My understanding is this pull request was opened by an automated service, which did not fully understand what it was doing.

@igr, what do you think about mentioned data validation in HttpBase?