Improper Neutralization of CRLF Sequences in HTTP Headers (CWE ID 113)

Question

Anyone have idea on how to fix this veracode issue (CWE 113)

I already tried below link but its not working.

Fix for CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')

Below is the function where I have issue.

protected void Page_Load(object sender, EventArgs e)
        {
            _presenter = new VwCSVPresenter(this);
            this._presenter.OnViewLoaded();

            Response.ContentType = CONTENT_TYPE;
            Response.Clear();
            if (!string.IsNullOrEmpty(this.FileName))
            {
                // name the local file the user will download
                var localFileName = Request.QueryString[QS_MODULE];
                //test1: var localFileName = Regex.Replace(Request.QueryString[QS_MODULE], @"\n|\r|%0d|%0D|%0a|%0A", string.Empty);
                //test2: tried the same with string Replace eg: 
                //var localFileName = Request.QueryString[QS_MODULE].Replace("\r", string.Empty)
                                //.Replace("%0d", string.Empty)
                                //.Replace("%0D", string.Empty)
                                //.Replace("\n", string.Empty)
                                //.Replace("%0a", string.Empty)
                                //.Replace("%0A", string.Empty);

                if (!string.IsNullOrEmpty(localFileName))
                    localFileName += CSV_EXTENSION;

                Response.AppendHeader(HTTP_HEADER_CONTENT_NAME, string.Format(HTTP_HEADER_CONTENT_VALUE, localFileName));
                Response.TransmitFile(this.FileName);
            }
            Response.End();
        }

Answer 1

I have fixed my issue by add Server.UrlEncode() for the localFieName and Varacode cleared the errors.

Response.AppendHeader(HTTP_HEADER_CONTENT_NAME, string.Format(HTTP_HEADER_CONTENT_VALUE, Server.UrlEncode(localFileName)));