cwe-93-crlf-injection

To prevent CRLF injection in Java HTTP headers and redirects, sanitize user input by replacing CR/LF characters and applying URL encoding to redirect URLs before passing them to response methods.

CWE-93 CRLF injection is a vulnerability where attackers manipulate HTTP headers or redirects by injecting malicious carriage return and line feed characters into unsanitized user input within Java response objects.

Sanitize user input for setHeader and sendRedirect in Java by applying string replacement to strip CR/LF characters from header values and using URL encoding for redirect target URLs.

This CRLF injection remediation works for Java web applications that directly use user input in response.setHeader or response.sendRedirect, specifically targeting vulnerabilities identified through static application security testing.

The best way to fix SAST detected CRLF injection vulnerabilities in Java is to deterministically refactor vulnerable code by replacing CR/LF characters in headers and URL encoding redirect parameters to sanitize inputs.