Allowing the characters '\r\n' by themselves introduces the vulnerability of HTTP Header injection. Recommend the implementer URI-encode header values as opposed to opening a security flaw via regex.

@kwwall This issue should be closed.

Allowing this would allow HTTP Response Splitting vulnerabilities as well as violating the HTTP 1.1 spec (RFC 2616). Since ESAPI is supposed to be a security library, we are not going to make changes that intentionally facilitate attacks. The Validator.HTTPParameterValue regular expression in ESAPI.properties file can be altered to accept this if you really want to shoot yourself in the foot. (Just change it to '.*'. That will do it and more!)

This "bug" will NOT be fixed (it's really NOT a bug). Closing the issue.