ER656919 (Community Member) asked a question.

November 16, 2018 at 10:13 PM
How can we get Veracode to know that we are using view models to avoid flaw 915 Improperly Controlled Modification of Dynamically-Determined Object Attributes

So this is the overposting flaw. We're using .net mvc and we only use view models for POSTs, but this flaw still comes up. Is there a way to get Veracode to realize that the class is a view model approach so we don't have to add unnecessary [Bind] attributes?

  • 2 answers
  • 1.3K views
ER656919 likes this.

  • kmorrison (Veracode)

    Unfortunately there's not an automated way to get the scanner to recognize this pattern. You most likely would need to use the workflow in the Veracode platform to mark those flaws as Mitigated-by-design.

    Selected as Best

  • kmorrison (Veracode)

    Unfortunately there's not an automated way to get the scanner to recognize this pattern. You most likely would need to use the workflow in the Veracode platform to mark those flaws as Mitigated-by-design.

    Selected as Best

  • Shuning, Veracode Community Manager (Veracode)

    Thank you, @kmorrison (Veracode)​, for providing your insights!

    Hi @ER656919 (Community Member)​, if you find what @kmorrison (Veracode)​ shared to be helpful, would you mind clicking on "Select as Best" button on his post? This will help other Community members with similar questions in the future. Thank you, and welcome to the Veracode Community!

Topics (2)

No articles found
Loading

Ask the Community

Get answers, share a use case, discuss your favorite features, or get input from the community.