Remove unexpected carriage returns and line feeds from user-supplied data

[ravisha andar]

Hi All,

I have a servlet where I am doing
String userName="abc";
response.sendirect("/jsp/temp.jsp?username="+userName);

But there is a vulnerability as stated by review team

It says
Remove unexpected carriage returns and line feeds from user-supplied data used to construct an HTTP response.


Can anybody help me with this ? What exacltly can be done?

Thanks

[Bear Bibeault]

First of all, the data should be encoded using URLEncoder.

Secondly, stripping any unwanted characters seems like a simple matter of string substitution.