{"action":"opened","issue":{"url":"https://api.github.com/repos/cakephp/cakephp/issues/7154","labels_url":"https://api.github.com/repos/cakephp/cakephp/issues/7154/labels{/name}","comments_url":"https://api.github.com/repos/cakephp/cakephp/issues/7154/comments","events_url":"https://api.github.com/repos/cakephp/cakephp/issues/7154/events","html_url":"https://github.com/cakephp/cakephp/issues/7154","id":98425842,"number":7154,"title":"sanitation issue of the Controller::header() function in library ","user":{"login":"bharat27","id":5388770,"avatar_url":"https://avatars.githubusercontent.com/u/5388770?v=3","gravatar_id":"","url":"https://api.github.com/users/bharat27","html_url":"https://github.com/bharat27","followers_url":"https://api.github.com/users/bharat27/followers","following_url":"https://api.github.com/users/bharat27/following{/other_user}","gists_url":"https://api.github.com/users/bharat27/gists{/gist_id}","starred_url":"https://api.github.com/users/bharat27/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bharat27/subscriptions","organizations_url":"https://api.github.com/users/bharat27/orgs","repos_url":"https://api.github.com/users/bharat27/repos","events_url":"https://api.github.com/users/bharat27/events{/privacy}","received_events_url":"https://api.github.com/users/bharat27/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-07-31T16:32:35Z","updated_at":"2015-07-31T16:32:35Z","closed_at":null,"body":"hey Team ,\r\n\r\nMy security team review our new application code and found out that the function Controller::header() in the cakephp library not using any mechanism to sanitation the parameter. When i investigate further i found that header() is simply passing the parameter to \"$this->response->header($status)\" which return the array of parameter in response without sanitizing it.\r\n\r\nCan you please let me know what will be the solution for this because security testing team will not pass our application without the proper solution or fix.\r\n\r\n\r\nThanks & Regards,\r\nBharat Bisht    "}}