MPetersen213821 (Community Member) asked a question.
I have a C# service library that contains, among other things, methods to make querying the database easier. The service library manages the connection and building the parameters to pass into the system code. In essence, I can write one line of code in my application rather doing the same 10 lines of code every time I want to execute a query. One of the parameters passed into the service library is a string with the basic query (in SQL). VeraCode is flagging methods in the service library as points of potential SQL injection for my web application. Since the methods in the service library aren't exposed via the web application, there is no way the methods could be exploited to perform a SQL injection attack (any more than the system methods that the service library uses which also accept strings for the basic query).
Is there a way to have VeraCode ignore the service library? The UI doesn't show a checkbox for the service library to select/unselect it as an entry point (which is how I thought I should handle this). If I exclude the service library DLL, VeraCode won't allow me to proceed with my scan.
Any suggestions?
Thanks
.png){kind=logo}
Hello,
In this case it is possible what is being detected is untrusted data being passed to the query from one of the callers. If the service dll is not being selected directly for scanning, it's not likely that the scanner is only looking at that method as the source of input, but it is looking at all of the callers of that method.
I would recommend ensuring that the callers are not concatenating untrusted data into the SQL query string before passing it onto this service library.
Thank you.
Thank you @sgibson (Veracode, Inc.) for responding!
Hi @MPetersen213821 (Community Member) , if you find what @sgibson (Veracode, Inc.) shared to be helpful, we'd appreciate if you could select her comment as the best answer (by clicking on "Select as Best" at the bottom of her post). This way you can help other Community member facing similar challenges access this thread and solution easier and faster😉 Thanks! Welcome again to the Veracode Community!
P.S. I'd like to introduce @sgibson (Veracode, Inc.) to you a little bit more. She is an Application Security Consultant (ASC) at Veracode. Our ASC team is formed by former developers with hands-on experience and expertise in AppSec, helping customers like yourself tackling the toughest AppSec challenges on a day-to-day basis.