/* goodB2G() - use badsource and goodsink */ public static void GoodB2GSink(CWE113_HTTP_Response_Splitting__Web_QueryString_Web_addCookie_67a.Container dataContainer, HttpRequest req, HttpResponse resp) { string data = dataContainer.containerOne; if (data != null) { HttpCookie cookieSink = new HttpCookie("lang", HttpUtility.UrlEncode(data, Encoding.UTF8)); /* FIX: use URLEncoder.encode to hex-encode non-alphanumerics */ resp.AppendCookie(cookieSink); } }
/* goodG2B() - use goodsource and badsink */ public static void GoodG2BSink(CWE113_HTTP_Response_Splitting__Web_QueryString_Web_addCookie_67a.Container dataContainer, HttpRequest req, HttpResponse resp) { string data = dataContainer.containerOne; if (data != null) { HttpCookie cookieSink = new HttpCookie("lang", data); /* POTENTIAL FLAW: Input not verified before inclusion in the cookie */ resp.AppendCookie(cookieSink); } }