title: HTTP Response splitting in case of java
body: <p>Is HTTP Response splitting possible in below case:</p>
  
  <pre><code>String requestFilename = request.getParameter("name");
  
  response.addHeader("content-disposition", "attachment; filename=" + requestFilename);
  </code></pre>
  
  <p>I am directly appending the unsanitized request parameter to the reponse header.</p>
  
  <p>My Question is that by using CRLF characters can we insert our own header into response.</p>
  
  <p>So far i have tried <code>\r\n</code> and <code>%0D%0A</code> but they do not work.</p>
  
  <p>Is <code>response.addHeader()</code> immune to such attacks?<br>
  Can someone explain it to me how this attack can be executed? </p>