ugotee160229 (Community Member) asked a question.
We did veracode scan on our web api (C#) code we are getting two errors in report-
1) CWE 73 (Directory Traversal) - It is occurring on File.Delete() call , we have added a validation method on file name but that didn't worked.
Code Example -
if(File.Exists(fileName))
{
File.Delete(fileName);
}
2) CWE 117 (CRLF Injection) - It is occurring on Log.Info() call while assigning any int variable into this method , we tried fixing this by using AntiXssEncoder.UrlEncode() method. But it didn't worked.
Example - Log.Info(MethodName + "MethodName. Parameter:" + AntiXssEncoder.UrlEncode(Parameter))
We have tried almost all suggestions provided for such problem but nothing is working.
So Please suggest us on this.
.png){kind=logo}
Hi @ugotee160229 (Community Member),
Thanks for your question.
Regarding the CWE-73 flaw please find below some questions you may wish to consider:
For the CWE-117 flaw, after looking at the code I note that AntiXssEncoder.UrlEncode will cleanse for CWE-117 however could there be other parameters that also need cleansing, for example MethodName?
We have some articles on how to remediate both these CWEs here which may be useful to you in fixing the flaws:
If you have tried a few suggestions and the flaw remains then I recommend you schedule a consultation call to discuss these flaws in detail and with the correct context of your application. You can check out this knowledge article (https://community.veracode.com/s/article/How-to-schedule-a-consultation-call) on how to schedule a consultation call with us.
Thanks,
Anthony
I am still waiting for the proper answer.