HTTP标头中CRLF序列的中和不正确（CWE ID 113）

Question

任何人都知道如何解决这个veracode问题（CWE 113）

我已尝试过以下链接，但它无效。

Fix for CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')

以下是我遇到问题的功能。

protected void Page_Load(object sender, EventArgs e)
        {
            _presenter = new VwCSVPresenter(this);
            this._presenter.OnViewLoaded();

            Response.ContentType = CONTENT_TYPE;
            Response.Clear();
            if (!string.IsNullOrEmpty(this.FileName))
            {
                // name the local file the user will download
                var localFileName = Request.QueryString[QS_MODULE];
                //test1: var localFileName = Regex.Replace(Request.QueryString[QS_MODULE], @"\n|\r|%0d|%0D|%0a|%0A", string.Empty);
                //test2: tried the same with string Replace eg: 
                //var localFileName = Request.QueryString[QS_MODULE].Replace("\r", string.Empty)
                                //.Replace("%0d", string.Empty)
                                //.Replace("%0D", string.Empty)
                                //.Replace("\n", string.Empty)
                                //.Replace("%0a", string.Empty)
                                //.Replace("%0A", string.Empty);

                if (!string.IsNullOrEmpty(localFileName))
                    localFileName += CSV_EXTENSION;

                Response.AppendHeader(HTTP_HEADER_CONTENT_NAME, string.Format(HTTP_HEADER_CONTENT_VALUE, localFileName));
                Response.TransmitFile(this.FileName);
            }
            Response.End();
        }

Answer 1

我已为Server.UrlEncode()添加localFieName修正了我的问题，Varacode清除了错误。

Response.AppendHeader(HTTP_HEADER_CONTENT_NAME, string.Format(HTTP_HEADER_CONTENT_VALUE, Server.UrlEncode(localFileName)));