I've been told that using
HttpServletRequest.getQueryString() in a response header makes my application susceptible to HTTP response splitting attacks, but I just don't see how.
It's clear in the case of
getParameter(String), which decodes percent-encoded values, but
getQueryString() does not do that. From the documentation:
The value is not decoded by the container.
Source code snippet illustrating what I'm doing:
String path = "some_url"; String qs = req.getQueryString(); if (qs != null) path += "?" + qs; // response instanceof HttpServletResponse response.setStatus(HttpServletResponse.SC_MOVED_TEMPORARILY); response.setHeader("Location", path);
I tried to reproduce the issue, and I just get the percent-encoded newlines echoed back to me in the response. When I change the code to
getParameter(…), it works as expected (except that my container is nice enough to strip the newlines from the header value, but in theory at least it works). This similar question on Stack Overflow asks the same, and a comment to the answer pointing out that
getQueryString() does not decode got no response.
Am I missing something here? Or is the advice I got wrong?