title: Does putting request.getQueryString in response.sendRedirect make you vulnerable to HTTP Response Splitting?
body: <p>I made this minimal JSP:</p>
  
  <pre><code>&lt;%
      response.sendRedirect(request.getQueryString());
  %&gt;
  </code></pre>
  
  <p>Obviously it's not very useful, but it is enough to trigger a FindBugs warning I am also getting on my real JSP:</p>
  
  <blockquote>
    <p>This code directly writes an HTTP parameter to an HTTP header, which
    allows for a HTTP response splitting vulnerability</p>
  </blockquote>
  
  <p>However, I'm pretty sure FindBugs is wrong here.  Per <a href="http://docs.oracle.com/javaee/6/api/javax/servlet/http/HttpServletRequest.html#getQueryString()" rel="nofollow">the docs</a> <code>getQueryString</code> does not decode the query string, and I don't believe the encoded query string can contain a CRLF because it has to be in the request line.  So as far as I can tell, there's no way a CRLF could get in there.</p>
  
  <p>This toy page is going to have a problem if the query string is null, and the string will be interpreted as relative or not which is probably not great, but is there an HTTP response splitting vulnerability here?</p>
  
  <p>If there is, how could we prevent it?</p>