> For the complete documentation index, see [llms.txt](https://docs.sec1.io/user-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sec1.io/user-docs/4-sast/2-java/unsanitized-user-input-in-http-response-xss.md).

# Unsanitized user input in HTTP response (XSS)

## Overview

* **Rule ID**: `java_lang_http_response_splitting`
* **Applicable Languages**: Java
* **Weakness ID**: CWE-79

## Description

Including unsanitized user input in a HTTP response could allow an attacker inject Carriage Return Line Feed (CRLF) characters into the response. An entirely attacker-controlled response can then be returned, creating a cross-site scripting (XSS) vulnerability.

## Remediation Guidelines

* **Avoid** incorporating user input into cookies or other HTTP headers without appropriate sanitization to prevent attackers from exploiting the input to manipulate the response.

  ```java
  // Avoid this approach
  System.out.println(e); // Unsafe

  ```
* **To mitigate** the risk of response splitting and XSS attacks, ensure to remove CRLF sequences from user input. You can use the following code snippet as a reference for sanitizing input in Java:

  ```java
  var input = request.getParameter("data");
  var sanitized = input.replaceAll("\r\n", "");
  cookie.setValue(sanitized);
  ```

## References

* [**CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')**](https://cwe.mitre.org/data/definitions/79.html)
* [**OWASP Top 10: A03:2021 - Injection**](https://owasp.org/Top10/A03_2021-Injection/)

## Configuration

To omit this rule during a scan, and to provide you with continuous 24/7 code-level scanning, you can employ our [**SAST TOOL**](https://scopy.sec1.io/login)