Fortify Issue: Header Manipulation

[cmheazel]

HTTPParser.java copies the Content-Type header from an inbound HTTP stream to an outbound HTTP steam without validating its contents. This opens the door to a number of exploits including cache-poisoning, cross-site scripting, cross-user defacement, page hijacking, cookie manipulation and open redirect. Planned solution is to use regular expressions to validate the mime type prior to copying.

[cmheazel]

Further investigation suggests that the best solution to this issue is to include argument validation logic in HttpURLConnection for all set operations. However, that class is part of the Java platform and outside of the scope of this source.

Recommendation to the CITE SC: investigate the degree of validation performed by the existing java.net.HttpURLConnection class and promote development of an improved version if necessary.