CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')

The following code segment reads the name of the author of a weblog entry, author, from an HTTP request and sets it in a cookie header of an HTTP response.

Assuming a string consisting of standard alpha-numeric characters, such as "Jane Smith", is submitted in the request the HTTP response including this cookie might take the following form:

String author = request.getParameter(AUTHOR_PARAM);...Cookie cookie = new Cookie("author", author);cookie.setMaxAge(cookieExpiration);response.addCookie(cookie);

The following code is a workflow job written using YAML. The code attempts to download pull request artifacts, unzip from the artifact called pr.zip and extract the value of the file NR into a variable "pr_number" that will be used later in another job. It attempts to create a github workflow environment variable, writing to $GITHUB_ENV. The environment variable value is retrieved from an external resource.

The code does not neutralize the value of the file NR, which is attacker controlled because it originates from a pull request that produced pr.zip. The attacker could escape the existing pr_number and create a new variable using a "\n" (CWE-93) followed by any environment variable to be added such as:

name: Deploy Preview 		jobs: 		 		  deploy: 		   		    runs-on: ubuntu-latest 		    steps: 		     		      - name: 'Download artifact' 		      uses: actions/github-script 		      with: 		       			script: | 			 			  var artifacts = await github.actions.listWorkflowRunArtifacts({ 			   			    owner: context.repo.owner, 			    repo: context.repo.repo, 			    run_id: ${{ github.event.workflow_run.id }}, 			   			  }); 			  var matchPrArtifact = artifacts.data.artifacts.filter((artifact) => { 			   			    return artifact.name == "pr" 			   			  })[0]; 			  var downloadPr = await github.actions.downloadArtifact({ 			   			    owner: context.repo.owner, 			    repo: context.repo.repo, 			    artifact_id: matchPrArtifact.id, 			    archive_format: 'zip', 			   			  }); 			  var fs = require('fs'); 			  fs.writeFileSync('${{github.workspace}}/pr.zip', Buffer.from(downloadPr.data)); 			 		       		      - run: | 		       			unzip pr.zip 			echo "pr_number=$(cat NR)" >> $GITHUB_ENV

The following code is a workflow job written using YAML. The code attempts to download pull request artifacts, unzip from the artifact called pr.zip and extract the value of the file NR into a variable "pr_number" that will be used later in another job. It attempts to create a github workflow environment variable, writing to $GITHUB_ENV. The environment variable value is retrieved from an external resource.

The code does not neutralize the value of the file NR, which is attacker controlled because it originates from a pull request that produced pr.zip. The attacker could escape the existing pr_number and create a new variable using a "\n" (CWE-93) followed by any environment variable to be added such as:

The code could be modified to validate that the NR 		file only contains a numeric value, or the code could 		retrieve the PR number from a more trusted source.

If user input data that eventually makes it to a log message isn't checked for CRLF characters, it may be possible for an attacker to forge entries in a log file.

logger.info("User's street address: " + request.getParameter("streetAddress"));