PSousa989544 (Community Member) asked a question.

July 17, 2019 at 9:13 PM
Improper Resource Shutdown or Release: .NET CORE 2.2

Hi everybody,

 

I have a code used for iterate the List and add some files in a zip file.

I'm using StreamWriter inside de using quote, but Veracode is always reporting CWE - 404: Improper Resource Shutdown or Release

 

Using quotes always closes and disposes the object after the end of the process. Why Veracode doesn't recognize these quotes. See my code on below:

 

IEnumerable<ArquivoDTO> notas = await ObterNotas(codigosParticionados);

              foreach (ArquivoDTO nota in notas)

              {

                ZipArchiveEntry archiveEntry = zipArchive.CreateEntry($"{nota.Name}.xml", CompressionLevel.Optimal);

                using (StreamWriter writer = new StreamWriter(archiveEntry.Open()))

                {

                  await writer.WriteAsync(nota.Xml);

                }

              }

 

These flaw can be a false positive?

 

  • 7 answers
  • 3.46K views

  • Dennis, Principal Security Consultant (Veracode)

    The USING keyword provides the necessary controls for ensuring the resource is disposed of in synchronous code. The platform is not recognize this USING because the use of asynchronous behavior. The actual implementation would instantiate the StreamWriter and then pass it to the thread. When an exception happens it is dealt with in the thread and closes the resource within that thread. It is this designed separation for responsibility that the platform cannot detect. As the try..catch that is actually being performed is not within the location of the creation of the object but within a separate thread. You'll need to mitigate the issue by design and document the using functionality is providing protection.

    Expand Post

    • JGray865962 (Community Member)

      Thank you for your explanation to does help. But as a developer a simple example to show how to implement what you are describing would go 1000 times further. What you are explaining is academic and not actual. So now I have to go out and find the solution that matches your academic explanation. You would save so much time so many developers using your tool if you would proved real examples.

      Expand Post

    • JGray865962 (Community Member)

      even when using the:

      await using(..){} your code throws this error. Which is the answer to your statement above

Topics (4)

No articles found
Loading

Ask the Community

Get answers, share a use case, discuss your favorite features, or get input from the community.