Multiple choice technology security

Which attack(s) are possible in the below code:

<% response.sendRedirect("/with_lang.jsp?lang="+request.getParameter("language")); %>

  1. Content Spoofing

  2. HTTP Response Splitting

  3. Directory Listing

  4. a & b

Reveal answer Fill a bubble to check yourself
D Correct answer
Explanation

The code unsafely concatenates a user-controlled parameter directly into the redirect header location. This allows attackers to perform CRLF injection to inject headers, leading to HTTP response splitting, and craft arbitrary redirects, leading to content spoofing (phishing) attacks.