How to check CRLF characters in http request

To check for CRLF characters in an HTTP request in Java, you can intercept and inspect the request headers or body. This can be done in a web application using a servlet filter or a Spring interceptor. Below is an example using a servlet filter.

Using a Servlet Filter to Check for CRLF Characters in HTTP Requests

Create the Filter:

java

import java.io.IOException;

import javax.servlet.Filter;

import javax.servlet.FilterChain;

import javax.servlet.FilterConfig;

import javax.servlet.ServletException;

import javax.servlet.ServletRequest;

import javax.servlet.ServletResponse;

import javax.servlet.http.HttpServletRequest;

public class CRLFFilter implements Filter {

@Override

public void init(FilterConfig filterConfig) throws ServletException {

// Initialization logic if needed

}

@Override

public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)

throws IOException, ServletException {

if (request instanceof HttpServletRequest) {

HttpServletRequest httpRequest = (HttpServletRequest) request;

// Check headers for CRLF characters

boolean hasCRLFInHeaders = httpRequest.getHeaderNames().asIterator().hasNext() && checkHeadersForCRLF(httpRequest);

// Check body for CRLF characters (if applicable)

boolean hasCRLFInBody = checkBodyForCRLF(httpRequest);

if (hasCRLFInHeaders || hasCRLFInBody) {

var headerNames = request.getHeaderNames();

while (headerNames.hasMoreElements()) {

String headerName = headerNames.nextElement();

String headerValue = request.getHeader(headerName);

filterCRLFErrorFromHttpHeaders(headerValue);

}

StringBuilder body = new StringBuilder();

String line;

var reader = request.getReader();

while ((line = reader.readLine()) != null) {

body.append(line);

}

filterCRLFErrorFromHttpHeaders(body.toString)

// throw new ServletException("CRLF characters found in HTTP request");

}

chain.doFilter(request, response);

}

@Override

public void destroy() {

// Cleanup logic if needed

}

private boolean checkHeadersForCRLF(HttpServletRequest request) {

var headerNames = request.getHeaderNames();

while (headerNames.hasMoreElements()) {

String headerName = headerNames.nextElement();

String headerValue = request.getHeader(headerName);

if (headerValue != null && headerValue.contains("\r\n")) {

return true;

}

return false;

}

private boolean checkBodyForCRLF(HttpServletRequest request) throws IOException {

StringBuilder body = new StringBuilder();

String line;

var reader = request.getReader();

while ((line = reader.readLine()) != null) {

body.append(line);

}

return body.toString().contains("\r\n");

}

/**

* This method will check for CRLF characters is present in the String or

* Not @ string is a String to check

* @return the String by removing the CRLF Characters

public static String filterCRLFErrorFromHttpHeaders(String string) {

String str = string;

if (str != null){

str = str.replaceAll("\n", "");

str = str.replaceAll("\r", "");

str = str.replaceAll("\t", "");

str = str.replaceAll("%0d", "");

str = str.replaceAll("%0a", "");

str = str.replaceAll("%250A", "");

str = str.replaceAll("%250D", "");

}

return str;

}

Register the Filter in web.xml:

xml

<filter-name>CRLFFilter</filter-name>

<filter-class>your.package.CRLFFilter</filter-class>

</filter>

<filter-mapping>

<filter-name>CRLFFilter</filter-name>

<url-pattern>/*</url-pattern>

</filter-mapping>

Or, if you're using Spring Boot, you can register the filter as a bean:

java

import org.springframework.boot.web.servlet.FilterRegistrationBean;

import org.springframework.context.annotation.Bean;

import org.springframework.context.annotation.Configuration;

@Configuration

public class FilterConfig {

@Bean

public FilterRegistrationBean<CRLFFilter> loggingFilter(){

FilterRegistrationBean<CRLFFilter> registrationBean = new FilterRegistrationBean<>();

registrationBean.setFilter(new CRLFFilter());

registrationBean.addUrlPatterns("/*");

return registrationBean;

}

Explanation

Filter Initialization (init): This method is used to initialize the filter. In this example, it does not contain any initialization logic.
Filter Execution (doFilter): This method is invoked for every request. It checks for CRLF characters in both headers and body of the request.

Check Headers: Iterates through all headers and checks if any header value contains \r\n.
Check Body: Reads the entire body of the request and checks if it contains \r\n.
filterCRLFErrorFromHttpHeaders: remove the CRLF characters if it is present in header or body

Filter Destruction (destroy): This method is used to clean up resources. In this example, it does not contain any cleanup logic.

Notes

Headers Checking: The method checkHeadersForCRLF iterates through the headers and checks for the presence of CRLF characters.
Body Checking: The method checkBodyForCRLF reads the request body line by line and checks for CRLF characters. This example assumes the body can be read as text.

This filter will throw a ServletException if it detects CRLF characters in the headers or body of the HTTP request, effectively blocking the request from proceeding if it contains these characters. This can help prevent certain types of injection attacks.