Is there a validation in ESAPI library that can make sure the CWE-93 vulnerability does not come up in veracode SAST scan?

Question

I did SAST scan of my code on Veracode platform and I got this vulnerability in Java mail functionality which I am using to send mails from my application. The following is the vulnerability that is coming - Improper Neutralization of CRLF Sequences('CRLF Injection') (CWE ID 93).

message.setSubject(subjectOfEmail);

I have heard that we can use ESAPI library but I cannot find an appropriate validation function for this. Someone please help me re-mediate this issue so that is does not come up in the scan again.

Answer 1

Check out this page on the Veracode Help Centre that lists out the validation libraries that will remediate certain flaw classes:

https://help.veracode.com/reader/DGHxSJy3Gn3gtuSIN2jkRQ/y52kZojXR27Y8XY51KtvvA

There are a whole slew of ESAPI libraries that will remediate CWSE 93 flaws, including

org.owasp.esapi.Encoder.encodeForHTML