Rule Definition
The software constructs all or part of a cookie via user-controllable inputs. These inputs are not neutralized or are incorrectly neutralized. These inputs in cookies may give attackers control of the remaining headers the application intends to send.

Remediation
Assume all input is malicious. Avoid using inputs. If it is not possible, use an "accept known good" input validation strategy, i.e., use stringent white-lists that limit the character set based on the expected value of the parameter in the request. This will indirectly limit the scope of an attack.

Violation Code Sample

System.Net.Cookie cookie = new System.Net.Cookie(taintedValue1, taintedValue2);
cookie.Domain = "contoso.com";
new CookieContainer().Add(cookie);

Fixed Code Sample

System.Net.Cookie cookie = new System.Net.Cookie(ESAPI.encoder().encodeForHTML(taintedValue1), ESAPI.encoder().encodeForHTML(taintedValue2));
cookie.Domain = "contoso.com";
new CookieContainer().Add(cookie);

CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers https://cwe.mitre.org/data/definitions/113.html