I'm auditing a piece of Java code that might be vulnerable to header injection :
String headerValue =request.getParameter("headerVal"); //escaping CRLF headerValue = headerValue.replace("\n", ""); headerValue = headerValue.replace("\r", ""); response.addHeader("myheader",redirection);
This code is present directly in the layer view (jsp).
As far as i know this piece of code completely do not take into account that CRLF could injected in different encoding according to my readings.
In other words, I would like to report to the DEV team as a Canonicalization issue.
Because I think that developers will deny it, I'm trying to setup a proof of concept with a HelloWorld project with Tomcat6 but it seems tomcat is preventing this in background.
Do you have any arguments other than Canonicalization to justify this flaw? Or Am I strongly wrong and this code is safe ? Thank you in advance.