PLucendo695196 (Community Member) asked a question.
CWE-73 issue in Java application
Hello Veracode community,
I am facing the CWE-73 after the scan on our Java based application. In order to fix it , I have read the following link:
CWE-73 is popping up on every instantiation of java.io.File. To avoid that, I have created a SecurityUtils class with a method
that retrieves a String with the path already verified. I have annotated this method with "@FilePathCleanser" , and I have replaced the input
of the instantiation of a java.io.File with this method(this approach is mentioned in the link above).
But after doing a veracode scan, the CWE-73 is still present. Do you know why is this still happening?.
Thank you for your support!
.png){kind=logo}
Hi @PLucendo695196 (Community Member) ,
As mentioned in the Java CWE 73 remediation article:
> Our engine will not detect the if clause so you will have to propose a mitigation specifying that you have this validation, where it is and how it blocks known bad values and contact the security team in your organization for approval (please note that Veracode does not approve or reject mitigation proposals).
A custom cleanser will propose a mitigation for you,
If so configured by your security team: https://help.veracode.com/reader/RXjxbTR2MDQdN3gX4l53CQ/qBpw6yXOpKGELy9APnDXIA .
I would recommend contacting your security team to discuss mitigation process.
Please let me know if you have any remaining questions or concerns.
Thank you,
Boy Baukema