c# - 如何修复 "Improper Neutralization of CRLF Sequences in HTTP Headers (' HTTP 响应拆分')”

Question

运行VeraCode后，在如下代码片段中报错“Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')”:

protected override void InitializeCulture() {
        //If true then setup the ability to have a different culture loaded
        if (AppSettings.SelectLanguageVisibility) {
            //Create cookie variable and check to see if that cookie exists and set it if it does.
            HttpCookie languageCookie = new HttpCookie("LanguageCookie");
            if (Request.Cookies["LanguageCookie"] != null)
                languageCookie = Request.Cookies["LanguageCookie"];

            //Check to see if the user is changing the language using a query string.
            if (Server.UrlDecode(Request.QueryString["l"]) != null)
                languageCookie.Value = Server.UrlDecode(Request.QueryString["l"]);

            //Check to make sure the cookie isn't null and set the culture variable to auto if it is and the value of the cookie if it isn't.
            if (languageCookie.Value == null)
                languageCookie.Value = string.Empty;

            string culture = languageCookie.Value.ToString();
            if (string.IsNullOrEmpty(culture))
                culture = "Auto";

            //Use to set the Culture and UI Culture.
            this.UICulture = culture;
            this.Culture = culture;
            if (culture != "Auto") {
                //If culture is changed set the new Current Culture and CurrentUICulture.
                System.Globalization.CultureInfo ci = new System.Globalization.CultureInfo(culture);
                System.Threading.Thread.CurrentThread.CurrentCulture = ci;
                System.Threading.Thread.CurrentThread.CurrentUICulture = ci;
            }

            //Update the cookie value with the new culture and initialize the culture.
            Response.Cookies.Set(languageCookie);
            Response.Cookies["LanguageCookie"].Expires = DateTime.Now.ToLocalTime().AddYears(1);
            Response.Cookies["LanguageCookie"].HttpOnly = true;
        }
        else {
            //Else keep language as English if localization is not enabled.
            this.UICulture = "en";
            this.Culture = "en";
        }

        base.InitializeCulture();
    }

报告指向包含以下代码的行:Response.Cookies.Set(languageCookie);可以使用什么修复来消除该错误？

谢谢

Answer 1

我相信问题是因为线

languageCookie.Value = Server.UrlDecode(Request.QueryString["l"]);

接受(不受信任的)用户输入(即 Request.QueryString["l"])。尝试添加一个函数调用，以在将查询字符串参数存储在 语言Cookie。

例如，您可以尝试将该行更改为:

languageCookie.Value = Server.UrlDecode(Request.QueryString["l"])
                         .Replace("\r", string.Empty)
                         .Replace("%0d", string.Empty)
                         .Replace("%0D", string.Empty)
                         .Replace("\n", string.Empty)
                         .Replace("%0a", string.Empty)
                         .Replace("%0A", string.Empty);

虽然这可能应该清理一下(我现在不是 C# 程序员)。

另见

• http://en.wikipedia.org/wiki/HTTP_response_splitting
• http://www.securiteam.com/securityreviews/5WP0E2KFGK.html
• https://www.owasp.org/index.php/Testing_for_HTTP_Splitting/Smuggling_(OWASP-DV-016)