Zennoxa Shield
Rules / PHP
SHIELD-PHP-017

HTTP header injection via dynamic header value

mediumPHPCWE-113CVSS 6.1

What it detects

A variable is passed to header(), allowing response splitting or header injection.

How to fix

Validate header values and strip CR/LF characters before calling header().

Vulnerable — Shield flags thisredirect.php
<?php
// redirect back to the page the user came from
$next = $_GET['next'] ?? '/dashboard';
header("Location: " . $next);
exit;
Fixed — scans cleanredirect.php
<?php
// redirect back to the page the user came from
$next = $_GET['next'] ?? '/dashboard';
$next = str_replace(["\r", "\n"], '', $next);
if (!preg_match('#^/[A-Za-z0-9/_-]*$#', $next)) {
    $next = '/dashboard';
}
header(sprintf('Location: %s', $next));
exit;

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-PHP-017, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-PHP-017: HTTP header injection via dynamic header value — Zennoxa Shield