RRamReddy226202 (Community Member) asked a question.
Improperly Controlled Modification of Dynamically-Determined Object Attributes
Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE ID 915)
I am getting this flaw even if I set the include/exclude properties of the model in my controller class.The problem here is the line number(location of the flaw) is showing as 1.I couldn't understand why the flaw locatin is 1(one).Is there any thing that I need to do in class(controller) level?.
Thanks in advance.
.png){kind=logo}
Great question, the bind include attribute should be the right approach for remediation the flaw. I recommend looking over this Microsoft article, which gives a great code example of how to use the bind attribute.
As for the line numbers, you may have a compilation or scan configuration issue, I recommend Scheduling a Consultation Call so an Application Security Consultant can review your packaging procedure to ensure all steps have been followed.
Microsoft: Bind Attribute
https://docs.microsoft.com/en-us/aspnet/mvc/overview/getting-started/getting-started-with-ef-using-mvc/implementing-basic-crud-functionality-with-the-entity-framework-in-asp-net-mvc-application#overpost
Scheduling a Consultation
https://help.veracode.com/reader/DGHxSJy3Gn3gtuSIN2jkRQ/bLo7cMy~2mOWtJ~kbrVzDg