Java: setCharacterEncoding NOT affected by HTTP Response Splitting

By YEHG -
<% 
String attacker_controlled_charset = "ISO-8859-1%0d%0aHacked-Response-Header: 1337";
response.setCharacterEncoding(attacker_controlled_charset);
%>


Comments

Post a Comment