A transit download response places an unsanitized user-controlled filename into Content-Disposition and related headers. What issue class should the tester emphasize?
Select an answer to reveal the explanation.
Short Explanation
Stuffing raw user text into HTTP headers is like writing graffiti on the shipping label — parsers get confused. Filenames in Content-Disposition need sanitizing or the response can split, cache weirdly, or trigger script-ish download themes. Keep the finding on safe header handling.
Full Explanation
Response header injection / unsafe Content-Disposition handling arises when untrusted filenames are placed unsanitized into download headers. A transit download response that embeds a user-controlled filename in Content-Disposition and related headers can enable header injection or file-download tricks that affect how browsers interpret the response—risking session issues or unexpected content handling for rider-facing downloads.
BGP hijacking is a network routing attack, not header injection from filenames. Filenames are not “irrelevant” when poorly encoded into headers. Missing HSTS preload alone does not capture this header-risk class.
Exam caveat: sanitize/encode filenames for header context, prefer server-generated names, and reject CR/LF and illegal characters. CPTS header-injection themes include CRLF and Content-Disposition abuses from user input.
Operational check: submit filenames with reserved/header-significant characters under RoE, confirm the transit app encodes or replaces them, use fixed download names where possible, and regression-test Content-Disposition outputs. Generate Content-Disposition filenames server-side from safe templates for transit downloads rather than echoing raw user strings into header values.