Question

I am passing directly a user defined parameter in my response header. Which I have learned is not a good idea since that way user can manipulate header and it can lead to Cross site scripting attacks and other kind of multiple attacks.

https://www.fortify.com/vulncat/en/vulncat/python/header_manipulation.html

What I am doing for preventing this is validate the user input for “http response splitting” by replacing “\r” and “\n” characters with empty string “”. Is this enough or I have to check for other characters also. Any pointers would be of great help.

This is my code.

if(response != null)
  {
   newResponse = response.replaceAll("[\r\n]", "");
  }

Is this enough for preventing this kind of attack or I should also validate for other characters.

Answer 1

A whitelist is much safer than a blacklist. Whether you can use a whitelist depends on how much you know about the user defined parameter.

More here:

http://cwe.mitre.org/data/definitions/113.html