Agent Wranglers

Injection Required

Strip line breaks from headers and logs

Remove or reject line breaks in any input that goes into a header, a redirect, an email header or a log line.

By Erik Bergstedt, Agent Wranglers. Updated .

How to do it

Most web frameworks refuse line breaks in headers, so keep yours up to date. Encode values in log lines, or log as JSON so each entry stays on one line. Check email addresses against a strict pattern before they reach the mail headers.

Example

// Log as JSON: a line break in input stays inside one entry
log.info(JSON.stringify({ event: 'login_failed', user: input }));

How to check

Send AW-TEST%0d%0aSet-Cookie:%20aw=1 in a redirect parameter and a contact form. No new header appears, and the log shows one line.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/injection/header-injection.