# V5630. OWASP. Possible cookie injection. Potentially tainted data is used to create a cookie.

The analyzer has detected that unverified external data is used to create a cookie object. If this data is compromised, it may cause a cookie injection.

The example:

    public void ChangeCookie()
    {
      String cookieValue = Request.Form["userRole"];

      Response.Cookies.Add(
        new HttpCookie(WebLocalizationConfiguration.CookieName, cookieValue)
        {
          Expires = Clock.Now.AddYears(2),
          Path = Request.ApplicationPath
        }
      );
      ....
    }

In this case, a new object of the `HttpCookie` class is added to `HttpResponse` and is initialized using the external data, `Request.Form`. Using data without any verification or validation can allow attackers to manipulate an application.

To protect code against cookie injections, ensure that any data used to initialize the `HttpCookie` object is validated.

The fixed code:

    public void ChangeCookie()
    {
      String cultureValue = Request.Form["userRole"];

      if (!Regex.IsMatch(cultureValue, DataValidationPattern))
        return;

      Response.Cookies.Add(
        new HttpCookie(WebLocalizationConfiguration.CookieName, cultureValue)
        {
          Expires = Clock.Now.AddYears(2),
          Path = Request.ApplicationPath
        }
      );
      ....
    }

Before initializing the `HttpCookie` object with potentially tainted data, execute a validation check via a regular expression.

This diagnostic is classified as:

CWE-113