private static String sanitizeUrl ( final String url ) { val m = NON_PRINTABLE . matcher ( url ) ; val sb = new StringBuffer ( url . length ( ) ) ; var hasNonPrintable = false ; while ( m . find ( ) ) { m . appendReplacement ( sb , " " ) ; hasNonPrintable = true ; } m . appendTail ( sb ) ; if ( hasNonPrintable ) { LOGGER . warn ( "The following redirect URL has been sanitized and may be sign of attack:\n[{}]" , url ) ; } return sb . toString ( ) ; }
Sanitize a URL provided by a relying party by normalizing non - printable ASCII character sequences into spaces . This functionality protects against CRLF attacks and other similar attacks using invisible characters that could be abused to trick user agents .