MPremkumar319398 (Community Member) asked a question.
Subject : Technology-Specific Input Validation Problems (CWE ID 100)
public List<string> ChangedProperties { get; set; }
public bool ShouldDisable { get; set; }
public BusinessRecipient()
{
ChangedProperties = new List<string>();
}
I have tried the data annotation solution
[Required]
public List<string> ChangedProperties { get; set; }
public bool ShouldDisable { get; set; }
public BusinessRecipient()
{
ChangedProperties = new List<string>();
}
.png){kind=logo}
Hi MPremkumar319398,
The Veracode Static Engine flags CWE 100 when we detect that a string property on a model is being used in a controller but does not have any Data Annotations that restrict it's content in any way.
You can find an introduction to this topic on MSDN: https://code.msdn.microsoft.com/Basic-Introduction-to-Data-244734a4 .
While the 'Required' attribute is a Data Annotation and is good to set for those attributes which are indeed required, it doesn't restrict the content in any way. An attacker might chose to put large amount of binary data in there, turning your application in to their file sharing service.
Without seeing more of your application I can't say much about what validation might be applicable to your "ChangedProperties" attribute.
Though typically, at the very least, I would recommend considering adding a StringLength attribute, to set an upper bound on the amount of data that's expected.
If you'd like to dive deeper into these flaws please feel free to schedule a Consultation with a Veracode Application Security Consultant (documentation on how to do that here: https://help.veracode.com/reader/DGHxSJy3Gn3gtuSIN2jkRQ/rbxN7jReTML7EEa7cr5Bkg ) or send an email to support@veracode.com .
Thank you,
Boy Baukema