BReed720612 (Community Member) asked a question.
Are annotations the only way to pass CWE ID 100 (insufficient input validation) in ASP.NET MVC?
We've used FluentValidation to do input validation, and now have over a thousand false positives in a Veracode scan. Is there any way to use other input validation strategies?
Similarly, Improperly Controlled Modification of Dynamically-Determined Object Attributes CWE ID 915.
This seems to only be a risk if the input model is bound directly somewhere, eg, with EntityFramework. Is there a way to avoid getting all these false positives?
.png){kind=logo}
There are several different types of CWE 100 found by the Veracode static scanner. For the variety that are associated with annotations on the model, they are the only thing the scanner is looking for.
For this type of check, the scanner does not recognize other input validation strategies, it is only looking to see if there are data annotations associated with the string attributes in the model.