YodaVC99 (Community Member) asked a question.
After running a static scan; my java code was flagged with CRLF injection flaws. So I modified the logging statements to use a custom class that in turn calls StringEscapeUtils.escapeJava to sanitize the input. But after making the changes & running the scan; it's still flagged with the same issue? What am I doing wrong? Thanks.
Hi @YodaVC99 (Community Member) ,
Veracode Static Analysis reports flaws of CWE 117 Improper Output Neutralization where it can detect that the application is composing log messages based on data from outside of the application (for example from the HTTP request, but also from files, database results, etc). The concern being that if you are using a simple line based log file and the attacker is able to inject CRLF characters then they can inject their own log lines into your application, which might be used to pollute log lines after an attack, causing your log files to become useless for auditing purposes.
StringEscapeUtils.escapeJava is a Supported Cleansing Function (https://help.veracode.com/reader/4EKhlLSMHm5jC8P8j3XccQ/IiF_rOE79ANbwnZwreSPGA ) for this CWE. If all variable data always passes through this function then this should be automatically detected and the flaw closed.
Do note that any bypass (if (data.equals("my\nsupported\newline") { log.error(data)}) will keep the flaw open.
Veracode Static Analysis is also unable to detect any functionality based on configuration or runtime behaviour (such as filters).
Unfortunately, to review why a flaw is not automatically closed, will require looking at the specific flaw with a Veracode Application Security Consultant. Please create a support case by clicking "Contact Support" in the avatar menu in the top right of the Community or schedule a consultation through the Veracode Platform ( https://help.veracode.com/reader/_xqy2rBkFBfaxzuiNu~wsg/kAO0UeevRvOPnidK6_e5IA ). In your support case / request please mention the flaw identifier as well as provide a link to the Veracode Platform results for the application ( starts with https://analysiscenter.veracode.com/ ).
Thank you,
Boy Baukema
Resolution - After meeting with a Veracode security consultant; we were able to figure out the issue. The reason the scan was still flagging issues was because I was using the latest version of StringEscapeUtils (from commons-text) & that is not a supported version by Veracode. When I switched to org.apache.commons.lang.StringEscapeUtils; the scan worked & didn't flag it as an issue any more. The reason I was using commons-text version is because I believe the commons.lang version is deprecated. Hopefully Veracode will upgrade it's scanning to support the newest version.
Thank you @YodaVC99 (Community Member) for letting us know the resolution!
Please file an idea at https://community.veracode.com/s/ideas to request research into and support for the newer version.
Thank you,
Boy Baukema
.png){kind=logo}
Resolution - After meeting with a Veracode security consultant; we were able to figure out the issue. The reason the scan was still flagging issues was because I was using the latest version of StringEscapeUtils (from commons-text) & that is not a supported version by Veracode. When I switched to org.apache.commons.lang.StringEscapeUtils; the scan worked & didn't flag it as an issue any more. The reason I was using commons-text version is because I believe the commons.lang version is deprecated. Hopefully Veracode will upgrade it's scanning to support the newest version.