ES-1975 (#1075)

Signed-off-by: ase-101 <[email protected]>
mosip · Dec 23, 2024 · 52faca3 · 52faca3
1 parent f2f3bbf
commit 52faca3
Showing 1 changed file with 2 additions and 3 deletions.
diff --git a/oidc-service-impl/src/main/java/io/mosip/esignet/services/AuthorizationServiceImpl.java b/oidc-service-impl/src/main/java/io/mosip/esignet/services/AuthorizationServiceImpl.java
@@ -341,12 +341,11 @@ public CompleteSignupRedirectResponse completeSignupRedirect(CompleteSignupRedir
     }
 
     //As pathFragment is included in the response header, we should sanitize the input to mitigate
-    //response splitting vulnerability
+    //response splitting vulnerability. Removed all whitespace characters
     private String sanitizePathFragment(String pathFragment) {
-        return pathFragment.replaceAll("[\r\n]", "");
+        return pathFragment.replaceAll("\\s", "");
     }
 
-
     private OIDCTransaction authenticate(AuthRequest authRequest, boolean checkConsentAction, HttpServletRequest httpServletRequest) {
         OIDCTransaction transaction = cacheUtilService.getPreAuthTransaction(authRequest.getTransactionId());
         if(transaction == null)