Agent WranglersAPS-6Recommended
Strip line breaks from headers and logs
Remove or reject line breaks in any input that goes into a header, a redirect, an email header or a log line.
How to do it
Most web frameworks refuse line breaks in headers, so keep yours up to date. Encode values in log lines, or log as JSON so each entry stays on one line. Check email addresses against a strict pattern before they reach the mail headers.
Examples
JavaScript example
// Log as JSON: a line break in input stays inside one entry
log.info(JSON.stringify({ event: 'login_failed', user: input }));Python example
# Python: one JSON object per line keeps a line break inside the value
logger.info(json.dumps({"event": "login_failed", "user": user_input}))How to check
Send PENTEST%0d%0aSet-Cookie:%20pt=1 in a redirect parameter and a contact form. No new header appears, and the log shows one line.
Sources
Related rules
- EML-1 Send the headers every message needs in Email
- EML-56 Never let visitors pick who gets your mail in Email
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/application-security/input-and-injection/header-injection">Agent Wranglers application security playbook</a>. In code you write, add a comment next to it with the same link.