CRLF / Line Injection Prevention (Newline Sanitization for Structured Formats)
Description
Prevents injection of carriage return (CR, \r) and line feed (LF, \n) characters into structured text formats where newlines serve as record or field delimiters. Enforces single-line invariants on input fields used to construct HTTP headers, log entries, configuration files, Git refs, email headers, and protocol messages. Strips or rejects input containing CR/LF before it reaches format-sensitive output contexts, preventing HTTP response splitting, log forging, configuration file injection, and Git ref manipulation. Complements HTTP header normalization (CME-912) by operating at the application input layer rather than the protocol proxy layer.
CVSS Vector Impacts
| Metric | Transition | Rationale |
|---|---|---|
| Attack Complexity (AC) | L → H | Newline characters in user input are stripped or rejected before reaching format-sensitive contexts; attacker cannot break record boundaries in HTTP headers, config files, Git refs, or log entries |
| Integrity (I) | H → L | Cannot forge log entries, split HTTP responses, inject configuration directives, or manipulate Git refs via embedded newlines |
CWE Relationships
Verification
Verify that input handling code strips or rejects CR/LF characters before constructing multi-line format outputs
# Expected: Newline sanitization present in input handling paths that feed into structured text formats
# Expected: Header-setting code validates input values do not contain CR/LF