Improper Neutralization of CRLF Sequences ('CRLF Injection')

  package main
  
  import (
-     "net/http"
-     "net/smtp"
- )
- 
- func handler(w http.ResponseWriter, r *http.Request) {
-     to := r.FormValue("to")
-     subject := r.FormValue("subject")
-     // Vulnerable: user input in email headers without validation
-     msg := []byte("To: " + to + "\r\nSubject: " + subject + "\r\n\r\nBody")
+     "errors"
+     "net/http"
+     "net/mail"
+     "net/smtp"
+     "strings"
+ )
+ 
+ func sanitizeHeader(s string) (string, error) {
+     if strings.ContainsAny(s, "\r\n") {
+         return "", errors.New("invalid characters in header")
+     }
+     return s, nil
+ }
+ 
+ func handler(w http.ResponseWriter, r *http.Request) {
+     to := r.FormValue("to")
+     subject := r.FormValue("subject")
+     // Validate email address
+     if _, err := mail.ParseAddress(to); err != nil {
+         http.Error(w, "Invalid email", 400)
+         return
+     }
+     // Reject CRLF in subject
+     safeSubject, err := sanitizeHeader(subject)
+     if err != nil {
+         http.Error(w, "Invalid subject", 400)
+         return
+     }
+     msg := []byte("To: " + to + "\r\nSubject: " + safeSubject + "\r\n\r\nBody")
      smtp.SendMail("smtp:25", nil, "[email protected]", []string{to}, msg)
  }
  

- app.post('/contact', async (req, res) => {
-   await transporter.sendMail({
-     to: req.body.email,
-     subject: req.body.subject,
+ const validator = require('validator');
+ 
+ app.post('/contact', async (req, res) => {
+   if (!validator.isEmail(req.body.email)) {
+     return res.status(400).json({ error: 'Invalid email' });
+   }
+   const safeSubject = req.body.subject.replace(/[\r\n]/g, '').slice(0, 200);
+   await transporter.sendMail({
+     to: '[email protected]',
+     subject: safeSubject,
      text: req.body.message
    });
  });
  

  from django.core.mail import send_mail
  
- def contact(request):
-     subject = request.POST.get('subject')
-     send_mail(
-         subject=subject,
+ def sanitize_header(value):
+     return value.replace('\r', '').replace('\n', '')
+ 
+ def contact(request):
+     subject = request.POST.get('subject', '')
+     safe_subject = sanitize_header(subject)
+     send_mail(
+         subject=safe_subject,
          message='Hello',
          from_email='[email protected]',
          recipient_list=['[email protected]']
      )