HTTP Header Injection & Response Splitting

// Node.js/Express - Secure header handling

// SECURE: Sanitization helper that removes CRLF
function sanitizeHeaderValue(value) {
  if (!value) return '';
  // Remove all CR, LF, and other control characters
  return String(value).replace(/[\r\n\x00-\x1F\x7F]/g, '');
}

// SECURE: URL validation helper
function isValidRedirectUrl(url) {
  try {
    const parsed = new URL(url, 'https://app.example.com');
    // Only allow same-origin redirects
    return parsed.origin === 'https://app.example.com';
  } catch {
    return false;
  }
}

// SECURE: Custom redirect header with sanitization
app.get('/goto', (req, res) => {
  const destination = req.query.dest || '/';
  
  // 1. Validate destination is safe URL
  if (!isValidRedirectUrl(destination)) {
    return res.status(400).json({ error: 'Invalid redirect destination' });
  }
  
  // 2. Sanitize value before setting header
  const safeDest = sanitizeHeaderValue(destination);
  
  // 3. Use framework's redirect instead of manual header
  // Express automatically sanitizes and validates
  res.redirect(safeDest);
});

// SECURE: Tracking with validation
app.get('/track', (req, res) => {
  const trackingId = req.query.tid;
  
  // Validate format - only allow alphanumeric and hyphens
  if (!/^[a-zA-Z0-9-]{1,64}$/.test(trackingId)) {
    return res.status(400).json({ error: 'Invalid tracking ID format' });
  }
  
  // Safe to use - validated against strict pattern
  res.setHeader('X-Tracking-Id', trackingId);
  
  res.json({ status: 'tracked' });
});

// SECURE: Use cookie API instead of manual header
app.post('/preferences', (req, res) => {
  const theme = req.body.theme;
  
  // Validate theme value against whitelist
  const ALLOWED_THEMES = ['light', 'dark', 'auto'];
  if (!ALLOWED_THEMES.includes(theme)) {
    return res.status(400).json({ error: 'Invalid theme' });
  }
  
  // SECURE: Use res.cookie() API which properly escapes values
  // Express handles encoding and prevents header injection
  res.cookie('theme', theme, {
    maxAge: 3600000,  // 1 hour
    httpOnly: true,
    secure: true,
    sameSite: 'strict',
    path: '/'
  });
  
  res.json({ message: 'Preferences saved' });
});

// SECURE: Redirect with validation
app.get('/external-redirect', (req, res) => {
  const targetUrl = req.query.url;
  
  // Whitelist allowed redirect destinations
  const ALLOWED_DOMAINS = new Set([
    'app.example.com',
    'www.example.com',
    'docs.example.com'
  ]);
  
  try {
    const parsed = new URL(targetUrl);
    
    // Validate protocol
    if (!['http:', 'https:'].includes(parsed.protocol)) {
      return res.status(400).json({ error: 'Invalid protocol' });
    }
    
    // Validate domain
    if (!ALLOWED_DOMAINS.has(parsed.hostname)) {
      return res.status(403).json({ error: 'Domain not allowed' });
    }
    
    // Use Express redirect which sanitizes Location header
    res.redirect(302, parsed.href);
    
  } catch (error) {
    res.status(400).json({ error: 'Invalid URL' });
  }
});

// SECURE: Debug endpoint with sanitization
app.get('/debug', (req, res) => {
  const userAgent = req.get('User-Agent') || 'unknown';
  const referer = req.get('Referer') || 'none';
  
  // Sanitize before echoing into response headers
  const safeUA = sanitizeHeaderValue(userAgent).substring(0, 200);
  const safeReferer = sanitizeHeaderValue(referer).substring(0, 200);
  
  res.setHeader('X-Client-UA', safeUA);
  res.setHeader('X-Referer', safeReferer);
  
  res.json({
    message: 'Debug info in headers',
    userAgent: safeUA,
    referer: safeReferer
  });
});

// SECURE: CORS with whitelist
const ALLOWED_ORIGINS = new Set([
  'https://app.example.com',
  'https://www.example.com',
  'https://partner.example.com'
]);

app.get('/api/data', (req, res) => {
  const origin = req.get('Origin');
  
  // Only set CORS header for whitelisted origins
  if (origin && ALLOWED_ORIGINS.has(origin)) {
    // Safe: origin is from our whitelist, but still sanitize
    res.setHeader('Access-Control-Allow-Origin', sanitizeHeaderValue(origin));
    res.setHeader('Access-Control-Allow-Credentials', 'true');
  }
  
  res.json({ data: 'sensitive information' });
});

// SECURE: Middleware to validate all headers before sending
app.use((req, res, next) => {
  const originalSetHeader = res.setHeader.bind(res);
  
  res.setHeader = function(name, value) {
    // Validate header value doesn't contain CRLF
    const strValue = String(value);
    if (/[\r\n]/.test(strValue)) {
      console.error(`Blocked header injection attempt in ${name}: ${strValue}`);
      throw new Error('Invalid header value');
    }
    
    return originalSetHeader(name, value);
  };
  
  next();
});