CSeaman145641 (Community Member) asked a question.
Using [ApiController] on your controller should make model validation automatic and return an HTTP 400 error upon failure in ASP.NET Core 2.1+, correct? If so, then Veracode, you should update this in your Static Scan logic.
Hi @CSeaman145641 (Community Member) ,
Yes, the [ApiController] attribute introduced in .NET Core 2.1 does make manual checking of the ModelState.IsValid obsolete as documented by Microsoft: https://docs.microsoft.com/en-us/aspnet/core/web-api/index?view=aspnetcore-2.1 .
For now please mark these flaws as Potential False Positive in the Veracode Platform
or IDE plugin ( https://help.veracode.com/reader/DGHxSJy3Gn3gtuSIN2jkRQ/~p4MSKOS8F8X8h0KwFTKoQ ) and have this reviewed by your security team.
Veracode Engineering is aware of this and working on updating the Veracode Static Analysis. To receive a notification when it has been updated you can find more on how to get notified about new release on our Help Centre: https://help.veracode.com/reader/kJC1iOtXp8N~rCtV8P9jhw/bvJJpfQ1tQEc8wpGdwjUhA .
Thank you,
Boy Baukema
.png){kind=logo}
Hi @CSeaman145641 (Community Member) ,
Yes, the [ApiController] attribute introduced in .NET Core 2.1 does make manual checking of the ModelState.IsValid obsolete as documented by Microsoft: https://docs.microsoft.com/en-us/aspnet/core/web-api/index?view=aspnetcore-2.1 .
For now please mark these flaws as Potential False Positive in the Veracode Platform
or IDE plugin ( https://help.veracode.com/reader/DGHxSJy3Gn3gtuSIN2jkRQ/~p4MSKOS8F8X8h0KwFTKoQ ) and have this reviewed by your security team.
Veracode Engineering is aware of this and working on updating the Veracode Static Analysis. To receive a notification when it has been updated you can find more on how to get notified about new release on our Help Centre: https://help.veracode.com/reader/kJC1iOtXp8N~rCtV8P9jhw/bvJJpfQ1tQEc8wpGdwjUhA .
Thank you,
Boy Baukema