From 19de13bdc7e84a92811b509fe780c711ddf1405b Mon Sep 17 00:00:00 2001
From: Luke Butters <lbutters@funnelback.com>
Date: Tue, 2 Apr 2019 18:00:52 +1100
Subject: [PATCH] Issue 6731 improve performance of checking headers

Improves the performance of checking headers for new lines.

Fixes: gh-6731
---
 .../security/web/firewall/FirewalledResponse.java            | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/web/src/main/java/org/springframework/security/web/firewall/FirewalledResponse.java b/web/src/main/java/org/springframework/security/web/firewall/FirewalledResponse.java
index b6a5035149..6d7c386563 100644
--- a/web/src/main/java/org/springframework/security/web/firewall/FirewalledResponse.java
+++ b/web/src/main/java/org/springframework/security/web/firewall/FirewalledResponse.java
@@ -16,7 +16,6 @@
 package org.springframework.security.web.firewall;
 
 import java.io.IOException;
-import java.util.regex.Pattern;
 
 import javax.servlet.http.Cookie;
 import javax.servlet.http.HttpServletResponse;
@@ -26,9 +25,9 @@ import javax.servlet.http.HttpServletResponseWrapper;
  * @author Luke Taylor
  * @author Eddú Meléndez
  * @author Gabriel Lavoie
+ * @author Luke Butters
  */
 class FirewalledResponse extends HttpServletResponseWrapper {
-	private static final Pattern CR_OR_LF = Pattern.compile("\\r|\\n");
 	private static final String LOCATION_HEADER = "Location";
 	private static final String SET_COOKIE_HEADER = "Set-Cookie";
 
@@ -76,6 +75,6 @@ class FirewalledResponse extends HttpServletResponseWrapper {
 	}
 
 	private boolean hasCrlf(String value) {
-		return value != null && CR_OR_LF.matcher(value).find();
+		return value != null && (value.indexOf('\n') != -1 || value.indexOf('\r') != -1);
 	}
 }