PBuckley209463 (Community Member) asked a question.
This is an asp.net core mvc 2.1 web application.
I cannot seem to get rid of this flaw. I'm checking ModelState.IsValid and returning out if false. I have the Bind attribute on parameters, and data annotations in the class. But the flaw persists.
For example the following snippet, with helpful validation failure messages removed, is still failing the check.
[HttpPost]
public async Task<IActionResult> RejectDocument([Bind(new string[] { "DocumentTypeId", "DocumentId", "NplReference", "Reason" })]RejectDocument rejectRequest)
{
if( ! ModelState.IsValid)
{
return BadRequest();
//return HttpResponseHelpers.ReturnAjaxFailedValidation(ModelState);
}
Model is;
public class RejectDocument
{
[Required]
public Guid? NplReference { get; set; }
[Range(1, Int32.MaxValue)]
public int DocumentTypeId { get; set; }
[Range(1, Int32.MaxValue)]
public int DocumentId { get; set; }
[MaxLength(500)]
public string Reason { get; set; }
}
.png){kind=logo}
Hello @PBuckley209463 (Community Member),
Thanks for your question. I note from the snippet the use of the bind annotation on the model passed to the controller, as well as the data annotations on the model properties. The inclusion of appropriate data annotations and model validation suggests you have remediated the flaw. The use of async is likely the reason for the flaw continuing to be reported. My recommendation would be to propose a mitigation by design and provide evidence of the controls in use: data annotations, use of ModelState.IsValid to perform the validation.
Kind regards,
Anthony Fielding