/* goodG2B() - use goodsource and badsink */ public static void GoodG2BSink(CWE113_HTTP_Response_Splitting__Web_Get_Cookies_Web_addHeader_67a.Container dataContainer, HttpRequest req, HttpResponse resp) { string data = dataContainer.containerOne; /* POTENTIAL FLAW: Input from file not verified */ if (data != null) { resp.AddHeader("Location", "/author.jsp?lang=" + data); } }
/* goodB2G() - use badsource and goodsink */ public static void GoodB2GSink(CWE113_HTTP_Response_Splitting__Web_Get_Cookies_Web_addHeader_67a.Container dataContainer, HttpRequest req, HttpResponse resp) { string data = dataContainer.containerOne; /* FIX: use URLEncoder.encode to hex-encode non-alphanumerics */ if (data != null) { data = HttpUtility.UrlEncode("", Encoding.UTF8); resp.AddHeader("Location", "/author.jsp?lang=" + data); } }