ARoy485811 (Community Member) asked a question.

Veracode not recognising annotated custome cleanser

I am calling my custom cleanser methos before redirection 

 

redirectionMethod{ 

customMethod(redirectURL);

final String encodedURL = ESAPI.encoder().encodeForURL(redirectURL);

response.sendRedirect(ESAPI.encoder().decodeFromURL(encodedURL));

}

 

@RedirectURLCleanser(userComment = "This mehod validates that redirectURL is an https one and is hosted by abc.com")

private void customMethod(String redirectURL) {

Pattern redirectURLValidator = Pattern.compile(WebConstants.REGEX);

if(!redirectURLValidator.matcher(redirectURL).matches()) {

throw new IntrusionException(REDIRECT_ERROR_LOG_MSG, REDIRECT_PATTERN_MATCH_ERROR_LOG_MSG);

}

}


  • HI @ARoy485811 (Community Member)​ ,

     

    Could you try removing the encoding and decoding?

    Veracode Static Analysis may detect it as an attempt to bypass it's analysis.

    If Veracode Static Analysis is still unable to recognize your Custom Cleanser please ensure it is enabled for your organization: https://help.veracode.com/reader/RXjxbTR2MDQdN3gX4l53CQ/qBpw6yXOpKGELy9APnDXIA .

    If you can confirm it is enabled for your organization, you are not encoding and decoding and it is still not recognized please contact Veracode Support by clicking your avatar in the top right corner of the Veracode Community.

     

    Thank you,

    Boy Baukema

    Expand Post

Topics (2)

No articles found
Loading

Ask the Community

Get answers, share a use case, discuss your favorite features, or get input from the community.