1

I read in a lot of articles including this and this one that we should always use a

function to encode the CR and LF special characters to prevent CRLF Injection,

but AFAIK to perform this attack the malicious user need not insert the string %0d%0a in the vulnerable page/parameter wich is already url-encoded, and when the web server render the infected response it will interpret the \r\n wich will lead to HTTP Response Splitting,

if so, then when the devloper need to use encoding ? and how it can be usefull to prevent this type of attack

  • very few platforms need to worry about "HTTP Response Splitting", which would only affect a bad low-level implementation. – dandavis Aug 7 '17 at 21:34

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.