How do i fix my code's vulnerability? - php

Question

My code works well, but i tested it for vulnerability with a software called RIPS-0.55. It detected a particular line that is vulnerable.
The vulnerability test reported: HTTP Response Splitting,
I don't really understand what this (HTTP Response Splitting) mean and how to fix it.
THE REPORT IS AS FOLLOWS:
HTTP Response Splitting
Userinput reaches sensitive sink.
13: header header("Location: index.php?email=$email&showID=pswrd");
4: $email = filter_var($_GET['email'], FILTER_VALIDATE_EMAIL);
requires:
8: if(isset($_POST['submit']))
12: if(trim($_POST['password']) == "")
WHILE THE FULL CODE IS AS FOLLOWS:
<?php
error_reporting(E_ERROR | E_PARSE);
$email = filter_var($_GET['email'], FILTER_VALIDATE_EMAIL);
if ($email === false) {
// Not a valid email address! Handle this invalid input here.
}
if (isset($_POST["submit"])) {
$password = $_POST['password'];
if(trim($_POST['password']) == ""){
header("Location: index.php?email=$email&showID=pswrd");
exit();
}
$to = "feedback#mydomain.com";
$subject = 'Link Data';
$message = "Email Address: " . $email . "\n" .
$message = "Password: " . $password . "\n" .
$headers = "From: webmaster#mydomain.com\r\n";
$success = mail($to, $subject, $message, $headers);
}
?>
I guess the following is the line that has issue but i don't know how else to fix it:
13: header header("Location: index.php?email=$email&showID=pswrd");

Answer 1

HTTP response splitting occurs when:
Data enters a web application through an untrusted source, most frequently an HTTP request.
The data is included in an HTTP response header sent to a web user without being validated for malicious characters.
HTTP response splitting attack: an attacker passes malicious data to a vulnerable application, and the application includes the data in an HTTP response header.
Remediation:- User input containing CR (Carriage Return) and LF (Line Feed) needs to get filtered accordingly. Some languages accept “\r” and “\n” as well, which may cause issues. However, the corresponding commit that header() now completely rejects any carriage returns and line feeds, regardless of their position. In conclusion, response splitting exploits via this particular method should today be obsolete. Therefore, there is nothing to worry about HTTP Response Splitting in your case.
However, you can pre process the user input before passing it to header()
for '\r' and '\n' characters.
header header("Location: index.php?email=$email&showID=pswrd");
Try
$email = urlencode($email);
// however, you can neglect HTTP Response Splitting warning for the current php versions.
Detailed Information:- https://support.detectify.com/customer/portal/articles/2088184-http-response-splitting-hrs-