# Improper Neutralization of CRLF Sequences ('CRLF Injection') (CWE-93)

The product uses CRLF (carriage return line feed) as a special element, e.g. to separate headers or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

- Prevalence: Média 3 linguagens cobertas
- Impact: Alto 3 regras de severidade alta
- Prevention: Documentada 3 exemplos de correção

**OWASP:** Injection (A03:2021-Injection) - #3

## Description

CRLF injection can be used to inject malicious headers in HTTP responses (HTTP response splitting), forge log entries, or manipulate other protocols that use CRLF as a delimiter.

## Prevention

Estratégias de prevenção para CRLF Injection baseadas em 3 regras de detecção do Shoulder.

### Go

Validate email addresses and reject input containing CRLF characters

### JavaScript

Validate email addresses and strip CRLF characters from header values

### Python

Strip newline characters from email headers before use

## Warning Signs

- [HIGH] email header injection vulnerabilities where user input flows into
email headers (To, From, Subject,
- [HIGH] user input used in email headers without newline sanitization

## Consequences

- Modificar dados da aplicação
- Executar código não autorizado
- Ocultar atividades

## Mitigations

- Remova ou codifique sequências CRLF de toda entrada usada em cabeçalhos ou logs
- Use frameworks que cuidem automaticamente da codificação de cabeçalhos
- Valide que as entradas não contenham caracteres de controle inesperados

## Detection

- Total rules: 3
- Languages: go, javascript, typescript, python

## Rules by Language

### Go (1 rules)

- **Email Header Injection** [HIGH]: User input flows into email headers without CRLF validation.
  - Remediation: Reject input containing CRLF characters and validate email addresses.

```go
func sanitizeHeader(s string) (string, error) {
    if strings.ContainsAny(s, "\r\n") {
        return "", errors.New("invalid characters")
    }
    return s, nil
}

subject, err := sanitizeHeader(r.FormValue("subject"))
if err != nil {
    http.Error(w, "Invalid input", 400)
    return
}
```

Learn more: https://shoulder.dev/learn/go/cwe-93/email-header-injection

### Javascript (1 rules)

- **Email Header Injection** [HIGH]: Detects email header injection vulnerabilities where user input flows into
email headers (To, From, Subject, Cc, Bcc) without validation. Attackers can
inject CRLF sequences (\r\n) to add arbitrary headers or body content.

Attack impact:
- Send spam/phishing emails via your server
- Add hidden recipients (Cc/Bcc injection)
- Modify email content
- Bypass spam filters using your domain reputation

Common vulnerable patterns:
- nodemailer with user-controlled options
- SendGrid/Mailgun APIs with 
  - Remediation: Validate email addresses and remove CRLF from header values:

```javascript
const validator = require('validator');

function sanitizeHeader(value) {
  return value.replace(/[\r\n]/g, '');
}

if (!validator.isEmail(email)) {
  return res.status(400).json({ error: 'Invalid email' });
}

const safeSubject = sanitizeHeader(subject).slice(0, 200);
await transporter.sendMail({
  to: 'admin@example.com',
  subject: `Contact: ${safeSubject}`,
  text: message
});
```

Learn more: https://shoulder.dev/learn/javascript/cwe-93/email-header-injection

### Typescript (1 rules)

- **Email Header Injection** [HIGH]: Detects email header injection vulnerabilities where user input flows into
email headers (To, From, Subject, Cc, Bcc) without validation. Attackers can
inject CRLF sequences (\r\n) to add arbitrary headers or body content.

Attack impact:
- Send spam/phishing emails via your server
- Add hidden recipients (Cc/Bcc injection)
- Modify email content
- Bypass spam filters using your domain reputation

Common vulnerable patterns:
- nodemailer with user-controlled options
- SendGrid/Mailgun APIs with 
  - Remediation: Validate email addresses and remove CRLF from header values:

```javascript
const validator = require('validator');

function sanitizeHeader(value) {
  return value.replace(/[\r\n]/g, '');
}

if (!validator.isEmail(email)) {
  return res.status(400).json({ error: 'Invalid email' });
}

const safeSubject = sanitizeHeader(subject).slice(0, 200);
await transporter.sendMail({
  to: 'admin@example.com',
  subject: `Contact: ${safeSubject}`,
  text: message
});
```

Learn more: https://shoulder.dev/learn/javascript/cwe-93/email-header-injection

### Python (1 rules)

- **Email Header Injection** [HIGH]: Detects user input used in email headers without newline sanitization.
  - Remediation: Remove newlines from email headers before use.

```python
safe_subject = subject.replace('\r', '').replace('\n', '')
```

Learn more: https://shoulder.dev/learn/python/cwe-93/email-injection