public static String stripMaliciousHeaderChars(@Nullable String input) {
        if (input == null) {
            return null;
        }
        // TODO(carl-mastrangelo): implement this more efficiently.
        for (char c : MALICIOUS_HEADER_CHARS) {
            if (input.indexOf(c) != -1) {
                input = input.replace(Character.toString(c), "");
            }
        }
        return input;
    }
Ensure decoded new lines are not propagated in headers, in order to prevent XSS

@param input - decoded header string
@return - clean header string
zuul-core/src/main/java/com/netflix/zuul/util/HttpUtils.java