8000 (CodeQL) Introduced protections against HTTP header injection / smuggling attacks by pixeebot-helm-test[bot] · Pull Request #5 · hintwatermelon/roller3 · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

(CodeQL) Introduced protections against HTTP header injection / smuggling attacks #5

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

(CodeQL) Introduced protections against HTTP header injection / smuggling attacks #5

wants to merge 1 commit into from

Conversation

pixeebot-helm-test[bot]
Copy link

Remediation

This change fixes findings identified by CodeQL.

Details

This change ensures that HTTP response header values can't contain newline characters, leaving you vulnerable to HTTP response splitting and other attacks.

If malicious users can get newline characters into an HTTP response header, they can inject and forge new header values that look like they came from the server, and trick web gateways, proxies, and browsers. This leads to vulnerabilities like Cross-site Scripting (XSS), HTTP response splitting, and more attacks from there.

Our change simply makes sure that if the string passed to be a new response header value is non-null, all the newline characters (CR and LF) will be removed:

+ import io.github.pixee.security.Newlines;
  ...
  String orderId = getUserOrderId();
- response.setHeader("X-Acme-Order-ID", orderId);
+ response.setHeader("X-Acme-Order-ID", Newlines.stripAll(orderId));

Note: Many modern application servers will sanitize these values, but it's almost never specified in documentation, and thus there is little guarantee against regression. Given that, we still recommend this practice.

More reading

I have additional improvements ready for this repo! If you want to see them, leave the comment:

@pixeebot next

... and I will open a new PR right away!

🧚🤖 Powered by Pixeebot

Feedback | Community | Docs | Codemod ID: codeql:java/http-response-splitting

@pixeebot-helm-test pixeebot-helm-test bot mentioned this pull request Dec 2, 2024
Open
github-advanced-security[bot]
github-advanced-security bot found potential problems Dec 2, 2024
View reviewed changes
app/src/main/java/org/apache/roller/weblogger/webservices/oauth/AuthorizationServlet.java
@@ -152,7 +152,7 @@
}

response.setStatus(HttpServletResponse.SC_MOVED_TEMPORARILY);
response.setHeader("Location", callback);
response.setHeader("Location", stripNewlines(callback));

Check warning

Code scanning / CodeQL

URL redirection from remote source Medium

Untrusted URL redirection depends on a
user-provided value
Loading
.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants
0