RPuripanda960221 (Community Member) asked a question.
I am getting Flaw from Veracode Scan that "External Control of File Name or Path (CWE ID 73)" on below code. I have given the all possibilities what Veracode has suggested. Please help to solve this issue.
string fullpath = @"D:\\FilePathTest\SourcePath\";
if (!System.IO.Directory.Exists(fullpath))
{
System.IO.Directory.CreateDirectory(fullpath);
}
What ever Veracode has suggested I have tried all scenarios but still I am getting the Flaw.
.png){kind=logo}
Hi @RPuripanda960221 (Community Member)
If you are using a hardcoded 'fullpath' variable and trying to create a directory, you can definitely flag this as a Potential False Positive.
But If you are using some variable in construction of the variable 'fullpath', and if any one of these variable is originating from untrusted sources, we need to ensure that sufficient mitigation and validations are in place.
Unfortunately, determining what and how you have implemented your mitigation is difficult. If you have any questions on this I would recommend scheduling a Consultation with a Veracode Application Security Consultant. You can find more on how to do this here: https://help.veracode.com/reader/_xqy2rBkFBfaxzuiNu~wsg/kAO0UeevRvOPnidK6_e5IA .
Regards
Kashifali