narayanayv (Community Member) asked a question.
Hi team, I am new to veracode, can you please guide me how can we resolve the above the above flaw.
Ask the Community
Get answers, share a use case, discuss your favorite features, or get input from the community.
By clicking “Accept All Cookies”, you agree to the storing of cookies on your device to enhance site navigation, analyze site usage, and assist in our marketing efforts.
.png){kind=logo}
These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the site will not then work. These cookies do not store any personally identifiable information.
These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site. All information these cookies collect is aggregated and therefore anonymous. If you do not allow these cookies we will not know when you have visited our site, and will not be able to monitor its performance.
These cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.
Hi @narayanayv (Community Member) ,
The remediation for CWE 829 is going to vary a bit based on your implementation. It would help us to determine the correct approach you should take if we had a bit more context about your application and the details around the flaw that was reported. I would recommend you schedule a consultation call to discuss this in more detail with a member of my team. You can check out this knowledge article (https://community.veracode.com/s/article/How-to-schedule-a-consultation-call) on how to schedule a consultation call with us.
Thanks,
Veasna Nhin
Senior Application Security Consultant
Hi,
You can find below my app scan results below, and please respond if any fix for this.
I am getting the exact same flaw as above screenshot.
Anybody has any idea how to fix this?
@narayanayv (Community Member) ,
Your screenshot does provide a bit more context around your initial question about CWE 829, however, it doesn't provide the complete picture. I assume your screenshot is in reference to a PDF report which only provide high level information about the CWE category and not specific details about the flaw. I recommend reviewing the flaw in Triage Flaws for your application scan to get a better understand what actually is being flagged.
Typically CWE 829 flaws found in dynamic scans are due to lack of a Content Security Policy (CSP). Lack of CSP in itself isn't a security risk but using a strict CSP provides additional protection against certain type of attacks (https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) . You can verify within the response header of your application whether CSP is used or not.
A couple CSP directive in particular that we advise on setting is the default-src and script-src . These will ensure that you're only allowing JavaScript that you have defined and trust. Other CSP directive like frame-ancestors might also be useful to set to prevent click-jacking and not allowing your site to be framed. Keep in mind that some browser don't support CSP or certain CSP directives. You'll need to make sure the CSP directives you're specifying will work correctly for your application.
Again, I would recommend you schedule a consultation call to discuss this in more detail with a member of my team. We can discuss the specifics around the flaw found in your application and what the appropriate approach would be to remediate. You can check out this knowledge article (https://community.veracode.com/s/article/How-to-schedule-a-consultation-call) on how to schedule a consultation call with us.
Thanks,
Veasna Nhin
Senior Application Security Consultant
Hi @vnhin (Veracode, Inc.) ,
Thanks for giving the information above, can you please help me where we can setup the CSP in webserver or else can you provide any reference link for CSP setup in webserver.
Thanks,
narayanayv.