HTTP Response Splitting in Styx

    static class VulnerablePlugin implements Plugin {

        @Override
        public Eventual<LiveHttpResponse> intercept(LiveHttpRequest request, Chain chain) {
            String header = request.queryParam("header-value").get();
            LiveHttpRequest newRequest = request.newBuilder()
                .header("myRequestHeader", header)
                .build();
            return chain.proceed(newRequest).map(response ->
                response.newBuilder().header("myResponseHeader", header).build()
            ) ;
        }

    }

    @Test
    public void simpleHeaderInjectionVulnerabilityPOC() {
        Plugin vulnerablePlugin = new VulnerablePlugin();
        // a simple way to mock the downstream system
        HttpInterceptor.Chain chain = request -> {
            assertThat(request.header("myRequestHeader").orElse(null), is("test\r\nAnother: CRLF_Injection"));
            return Eventual.of(response(OK).build());
        };

        // an example request you expect your plugin to receive
        String encodedGet = URLEncoder.encode("test\r\nAnother: CRLF_Injection");
        LiveHttpRequest request = get("/foo?header-value=" + encodedGet)
            .build();

        // since this is a test, we want to wait for the response
        LiveHttpResponse response = Mono.from(vulnerablePlugin.intercept(request, chain)).block();

        assertThat(response.header("myResponseHeader").orElse(null), is("test\r\nAnother: CRLF_Injection"));
    }