VERACODE：Cookies - JAVA 的 CRLF 中和警告

Question

recently after scanning our project we can across with Veracode warnings on CRLF neutralization. please find my error code below.

Cookie[] c = request.getCookies();

c[i].setValue("");

c[i].setMaxAge(0);

getting the issue on below line

response.addCookie(c[i]);

Solutions Tried: 1. setValue("") tried replacing with \r or \n 2. used Encode.forJava(String) 3. Used ESAPI, but our project is running on Java 1.6. No suitable ESAPI jar was found.

Any recommendations here? am I missing anything? Am I going in the wrong direction? Can anyone help me with this?

Answer 1

I don't think output encoding is the right approach here. Unless you are rendering the cookie name and/or value, the issue is not XSS, but rather HTTP Response Splitting.

Strict allow-listing is the best approach, here but if find that impossible (because you are not sure what the allowed values are supposed to be, which might be the case if you were writing an HTTP library or getting values from downstream processes, etc.), then go with block-list data validation. For the block-list approach, I recommend either outright rejecting any cookie containing ':', '=', '\r', or '\n' (and log an appropriate error) and redirect the user to any appropriate error page. Alternately, if you detect anything in the block list, you could simply ignore those values by just silently stripping them out (although you many want to log them).