HTTP header injection via xredirect

Reported by the dutch security audit.

It is possible to inject HTTP headers using the xredirect parameter. This can be used to inject cookies using Set-Cookie: header, and possibly inject malicious data into server logs.

http://localhost:8080/xwiki/bin/login/XWiki/XWikiLogin?xredirect=test%0d%0aX-Header:

This vulnerability does not seem to work on latest version of Jetty, and was fixed in at least Tomcat 5.5 in 2008 (see tomcat mailinglist: http://mail-archives.apache.org/mod_mbox/tomcat-dev/200803.mbox/%3C47E96A99.40808@hanik.com%3E). However, it might still be a good idea to remove newlines from xredirect and escape it in case some vulnerable container is used.