I have this application that has an input box where the data is going to be sent in a JSON format. The JSON payload might look like this
{“message”: “hello\nmy name is andi”}
But the problem is the \n is blocked by my WAF and so apparently the data is not being passed into the backend. I’ve tried encoding it into %0A and even tried double encoding it but still no luck.
The security department says they did this on purpose. But as far as I know, this might only be vulnerable to CRLF injection which uses both \r and \n. So I guess it’s fine to just enable \n and disable \r without causing any potential security risks?
\neven if some standard requires\r\n. So your security department might actually be right. What is not clear for me: did you include a plain new-line character or did you escape it as expected by JSON as\followed byn, i.e. two characters. See also How do I handle newlines in JSON?.\nis often accepted instead of\r\n. And I cannot say anything about the risks in your specific use case since there is not much known about it. Still, the question stands if you've even properly encoded it according to the JSON spec in the first place, i.e. as two and not one character (relevant is what is on the wire and not what you type in your code).\ncharacter but then there would be a two-character sequence instead consisting of\andn.