VSridharan272777 (Community Member) asked a question.
Required: Issue fix for CWE 73
Can someone help with the fix for CWE 73. In the below code i'm have experienced the issue.
try
{
String serviceFile = System.getProperty("PROP", "");
logger.info("service A", "Loading service file [" + serviceFile+ "].");//Security Issue CWE 73 Occurs in this line }
.png){kind=logo}
Hi @VSridharan272777 (Community Member) ,
There may be a difference between the code and what's scanned by Veracode Static Analysis as the line mentioned does not access files so should not be reported for CWE 73 (though it may be reported for CWE 117, to remediate CWE 117 I would recommend looking at our Supported Cleansing Functions: https://help.veracode.com/reader/4EKhlLSMHm5jC8P8j3XccQ/IiF_rOE79ANbwnZwreSPGA ).
To ensure the line numbers displayed are correct I would recommend doing a clean build confirming to our Compilation Guide: https://help.veracode.com/reader/4EKhlLSMHm5jC8P8j3XccQ/HQ0pp2GBWwN7Wl4GR7gQdQ and scanning this new build.
If you continue to have issues with incorrect line numbers please contact support by clicking your avatar in the Veracode Community and clicking "Contact Support" in the resultant menu or schedule a Consultation through the Veracode Platform. You can find more information on how to do this here: https://help.veracode.com/reader/DGHxSJy3Gn3gtuSIN2jkRQ/7YQTCDJKFEQzL3gL_N90hQ
Please let me know if you have any remaining questions or concerns.
Thank you,
Boy Baukema
Thanks for the update @Boy, Security Consultant (Veracode) . I made a mistake in my question. See below i have update my code
java.util.Properties a= new java.util.Properties();
try
{
String serviceFile = System.getProperty("PROP", "");
logger.info("service A", "Loading service file [" + serviceFile+ "].");
a .load((new java.io.FileInputStream(serviceFile));//Security Issue CWE 73 Occurs in this line }
Hi @VSridharan272777 (Community Member) ,
I would recommend reviewing the following article: https://community.veracode.com/s/article/how-do-i-fix-cwe-73-external-control-of-file-name-or-path-in-java .
From the code given I would recommend reviewing the section "Rely on trusted configuration".
Thank you,
Boy Baukema