CRLF Injection issue wrt microsoft_reportviewer_webforms_dll.Microsoft.Reporting.WebForms.ReportDataOperation

Question

Hi Team,
we are using Microsoft report viewer in one of our projects and recently our code is scanned by Veracode
and identified CRLF Injection issues with respect to improper nuetralization.
please find below the issue reported :
This call to system_web_dll.System.Web.HttpResponse.set_ContentType() contains an HTTP response splitting flaw. Writing unsanitized user-supplied input into an HTTP header allows an attacker
to manipulate the HTTP response rendered by the browser, leading to cache poisoning and cross-site scripting attacks. The first argument to set_ContentType() contains tainted data. The tainted data originated from an earlier call to system_dll.system.net.httpwebrequest.endgetresponse.
Remove unexpected carriage returns and line feeds from user-supplied data used to construct HTTP response headers. Whenever possible, use a security library such as ESAPI that provides safe
versions of addHeader(), etc. that will automatically remove unexpected carriage returns and line feeds and can be configured to use HTML entity encoding for non-alphanumeric data. Only write custom blacklisting code when absolutely necessary. Always validate
user-supplied input to ensure that it conforms to the expected format, using centralized data validation routines when possible.
References:
CWE (http://cwe.mitre.org/data/definitions/113.html)
OWASP (http://www.owasp.org/index.php/HTTP_Response_Splitting)
WASC (http://webappsec.pbworks.com/HTTP-Response-Splitting)

Answer 1

Is there any fix for the above veracode issue?
I too have a similar kind of issue:-
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')
Description
A function call contains an HTTP response splitting flaw. Writing unsanitized user-supplied input into an HTTP header
allows an attacker to manipulate the HTTP response rendered by the browser, leading to cache poisoning and crosssite
scripting attacks.
Recommendations
Remove unexpected carriage returns and line feeds from user-supplied data used to construct an HTTP response.
Always validate user-supplied input to ensure that it conforms to the expected format, using centralized data validation
routines when possible.
Instances found via Static Scan
MvcReportViewer.dll void SetStreamingHeaders(string,
System.Web.HttpResponse)