Fix for CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')

Question

After running veracode scan, I got the CWE 113 error. I had found a solution to replace the cookie value, but still the issue is not fixed.

Fix for CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')

string ReplaceHTTPRequestValue(string Value)
{
    string replacedValue = string.Empty;
    if (!string.IsNullOrEmpty(Value))
    {
        replacedValue = Value.Replace("\r", string.Empty)
                                .Replace("%0d", string.Empty)
                                .Replace("%0D", string.Empty)
                                .Replace("\n", string.Empty)
                                .Replace("%0a", string.Empty)
                                .Replace("%0A", string.Empty);
    }
    return replacedValue;
}

void WebTrends_PreRender()
{
    HttpCookie cookie = Request.Cookies["WT_CID"];
    string campaignIdVal = string.Empty;
    if (cookie != null)
    {
        campaignIdVal = ReplaceHTTPRequestValue(Request.Cookies["WT_CID"].Value);
    }
    else
    {
        campaignIdVal = string.Empty;
    }
}

How can I solve this?

Answer 1

Please take a look at this link https://community.veracode.com/s/question/0D53n00007YVaMrCAL/how-to-fix-flaws-for-cwe-id-113-http-response-splitting

It is likely the reason the flaw continues to be reported is because the functions you are using are not in the list of Supported Cleansing Functions, which you can find in the Help Center here: https://help.veracode.com/go/review_cleansers . For example the supported function org.owasp.encoder.Encode.forJava() would cleanse for CWE-113, as well as CWE-117, CWE-80 and CWE-93. Please note that it is important to select the appropriate cleansing function for the context.

Answer 2

string ReplaceHTTPRequestValue(string Value) {
string NonCRLF = string.Empty;

        foreach (char item in Value)
        {

            NonCRLF += item.ToString().Replace("\n", "").Replace("\r","");
        }
        return NonCRLF;
    }