I have this application that has an input box where the data is going to be sent in a JSON format. The JSON payload might look like this

{“message”: “hello\nmy name is andi”}

But the problem is the \n is blocked by my WAF and so apparently the data is not being passed into the backend. I’ve tried encoding it into %0A and even tried double encoding it but still no luck.

The security department says they did this on purpose. But as far as I know, this might only be vulnerable to CRLF injection which uses both \r and \n. So I guess it’s fine to just enable \n and disable \r without causing any potential security risks?

  • I have no idea what specific CRLF injection you refer too but it is common for applications to accept plain \n even if some standard requires \r\n. So your security department might actually be right. What is not clear for me: did you include a plain new-line character or did you escape it as expected by JSON as \ followed by n, i.e. two characters. See also How do I handle newlines in JSON?. – Steffen Ullrich Nov 27 '19 at 7:39
  • @SteffenUllrich I guess it's more like to prevent any general CRLF injections, they decided to just disable every '\r' '\n' . Is there like any major security risks for allowing just \n? – Andi Perkaa Nov 27 '19 at 7:43
  • As I said, \n is often accepted instead of \r\n. And I cannot say anything about the risks in your specific use case since there is not much known about it. Still, the question stands if you've even properly encoded it according to the JSON spec in the first place, i.e. as two and not one character (relevant is what is on the wire and not what you type in your code). – Steffen Ullrich Nov 27 '19 at 7:47
  • I'm pretty sure that my JSON is encoded properly since I can intercept the request and see that the payload contains for example : {"message" :"hello\nhi\n"}. The issue is really about the WAF not allowing any \n character – Andi Perkaa Nov 27 '19 at 7:53
  • "... WAF not allowing any \n character" - If the JSON was properly encoded then there would be no \n character but then there would be a two-character sequence instead consisting of \ and n. – Steffen Ullrich Nov 27 '19 at 9:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.