Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') [VID:113:github.com/govwa/util/cookie.go:38]

[veracode-workflow-app]

govwa//util/cookie.go

Lines 33 to 43 in 06b43e3

	//Path : "/",
	//Domain : "localhost",
	Name: name,
	Value: value,
	}
	http.SetCookie(w, &cookie)
	}
	func GetCookie(r *http.Request, name string)string{
	cookie, _ := r.Cookie(name)
	return cookie.Value

Filename: github.com/govwa/util/cookie.go

Line: 38

CWE: 113 (Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting'))

This call to net::http::SetCookie() contains an HTTP response splitting flaw. Writing untrusted input into an HTTP header allows an attacker to manipulate the HTTP response rendered by the browser, to inject additional headers or an entire response body into the response stream. Injecting headers can be used to trick various security mechanisms in browsers into allowing XSS style attacks. Injecting entire response bodies can not only cause XSS attacks to succeed but may even poison the cache of any intermediary proxies between the clients and the application server. The second argument to SetCookie() contains tainted data from the variable cookie. The tainted data originated from an earlier call to net.http.Request.FormValue. Escape, encode, or remove carriage return and line feed characters from untrusted data before inclusion in HTTP response headers. Whenever possible, use a security library such as ESAPI that provides safe versions of addHeader(), etc. that will automatically remove unexpected carriage returns and line feeds and can be configured to use HTML entity encoding for non-alphanumeric data. Alternatively, some of the XSS escaping functions from the OWASP Java Encoder project will also sanitize CRLF sequences. Only create a custom blocklist when absolutely necessary. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. References: CWE OWASP Supported Cleansers/nDon't know how to fix this? Don't know why this was reported?
Get Assistance from Veracode