View by Classes

Findings - Overview

warning HTTP Response splitting vulnerability (Findbugs)

HTTP parameter directly written to HTTP header output in org.jcoderz.phoenix.templategen.TemplateGeneratorServlet.parametrizeTemplate(HttpServletRequest, HttpServletResponse)

This code directly writes an HTTP parameter to an HTTP header, which allows for a HTTP response splitting vulnerability. See http://en.wikipedia.org/wiki/HTTP_response_splitting for more information.

FindBugs looks only for the most blatant, obvious cases of HTTP response splitting. If FindBugs found any, you almost certainly have more vulnerabilities that FindBugs doesn't report. If you are concerned about HTTP response splitting, you should seriously consider using a commercial static analysis or pen-testing tool.