Static Analysis Group (Archived) — DBraaten118366 (Community Member) asked a question.
Hi,
Static scans have just started flagging all our REST integrations where we fetch JSON and deserialize it with Newtonsoft.
The suggested remediation is to switch to a safer serialization scheme such as JSON. TypeNameHandling is using the default None so types should not be created from and $type$ properties in the incoming JSON.
Are there any recommendations for validations that can be done on JSON before deserialization that Veracode will recognize? Is there something in this warning that I am over looking?
One interesting thing is that CWE 502 is only coming up for one of the application we scan despite some of the code being identical.
Thanks
Darryl
.png){kind=logo}
Hi @DBraaten118366 (Community Member) ,
Thank you for reporting this. I've investigated this and unfortunately it appears that we do not currently take the TypeNameHandling into account. Please verify that you are using the default setting or TypeNameHandling.None in which case please mitigate the flaw as Potential False Positive . You can find more information on how to do this here: https://help.veracode.com/reader/DGHxSJy3Gn3gtuSIN2jkRQ/~p4MSKOS8F8X8h0KwFTKoQ . After proposing these mitigations they must be reviewed by a member of your security team, after approval the flaws will still be visible but will no longer affect the score of your application or it's passing of policy.
Veracode Engineering is investigating improving our support. To learn more on being notified on new updates of Veracode Static Analysis please see our documentation in the Help Centre: https://help.veracode.com/reader/kJC1iOtXp8N~rCtV8P9jhw/bvJJpfQ1tQEc8wpGdwjUhA .
Please let me know if you have any remaining questions or concerns.
Thank you,
Boy Baukema
Hi -
Will Veracode be fixing this rule to work correctly?
By default this control is safe and only because dangerous when the default setting is on the TypeNameHandler is set to Auto or All.
Given the usage of Json it would be good to have a valid rule instead of another false positive to have to address.
Hi @MEvans781392 (Community Member) ,
Yes, Veracode Engineering is actively working on improving our support for this flaw category.
To learn more on being notified on new updates of Veracode Static Analysis please see our documentation in the Help Centre: https://help.veracode.com/reader/kJC1iOtXp8N~rCtV8P9jhw/bvJJpfQ1tQEc8wpGdwjUhA .
Please let me know if you have any remaining questions or concerns.
Thank you,
Boy Baukema
I have one remaining question:
Is it fixed yet, or must I mitigate at this time?
Hi @VWynnytsky442609 (Community Member) ,
You must mitigate at this time.
Please let me know if you have any remaining questions or concerns.
Thank you,
Boy Baukema
I am getting this flaw too, I used TypeNameHandling but no help. Is there any update on this ?
Hi @BVail827987 (Community Member) ,
Our 2019 June release has added support for TypeNameHandling.
Could you provide an example where this is not correctly detected?
If you cannot publicly provide an example I would recommend contacting Support.
You can contact Veracode Support by clicking your avatar in the top right corner and clicking "Contact Support". In your support case please provide a URL to a scan on the Veracode Platform as well as the flaw id.
Thank you,
Boy Baukema