tomdesair / tus-java-server / 28939045472

95%

push

github

🛡️ Sentinel: [HIGH] Fix global CRLF injection in HTTP headers (#107)

* 🛡️ Sentinel: [HIGH] Fix global CRLF injection in HTTP headers

This commit introduces a robust, global defense against HTTP Response Splitting and CRLF Injection vulnerabilities.

Instead of patching individual endpoints and headers (such as Content-Disposition or Upload-Metadata) as they arise, `TusServletResponse.java` has been modified to intrinsically sanitize all outgoing header values by stripping carriage return (`\r`) and line feed (`\n`) characters before they are passed to the underlying HttpServletResponse wrapper.

The specialized `DownloadGetRequestHandlerCRLFTest.java` was removed and replaced with a broader `TusServletResponseCRLFTest.java` that covers `setHeader` and `addHeader` methods.
Additionally, `DownloadGetRequestHandler.java` was simplified slightly since the `TusServletResponse` now uniformly handles CRLF removal.

Co-authored-by: tomdesair <14034630+tomdesair@users.noreply.github.com>

* 🛡️ Sentinel: [HIGH] Fix global CRLF injection in HTTP headers

This commit introduces a robust, global defense against HTTP Response Splitting and CRLF Injection vulnerabilities.

Instead of patching individual endpoints and headers (such as Content-Disposition or Upload-Metadata) as they arise, `TusServletResponse.java` has been modified to intrinsically sanitize all outgoing header values by stripping carriage return (`\r`) and line feed (`\n`) characters before they are passed to the underlying HttpServletResponse wrapper.

The specialized `DownloadGetRequestHandlerCRLFTest.java` was removed and replaced with a broader `TusServletResponseCRLFTest.java` that covers `setHeader` and `addHeader` methods.
Additionally, `DownloadGetRequestHandler.java` was simplified slightly since the `TusServletResponse` now uniformly handles CRLF removal.

Co-authored-by: tomdesair <14034630+tomdesair@users.noreply.github.com>

---------

Co-authored-by: google-labs-jules[bot] <161369871+... (continued)

644 of 730 branches covered (88.22%)

Branch coverage included in aggregate %.

10 of 11 new or added lines in 2 files covered. (90.91%)

1847 of 1898 relevant lines covered (97.31%)

6.6 hits per line