KLaine375720 (Community Member) asked a question.
Hi, I'm having trouble when trying to fix (CWE ID 117 - Improper Output Neutralization for Logs.
We are using NLog, for .NET/C#, and we cannot change it. Our log entry contains some times several lines, but never HTML. I have updated our log writer so that it will replace '\n' and '\r' characters with '@' character. After still receiving error, I add to call to 'System.Security.SecurityElement.Escape'-method which is list of supported methods for escaping/encoding HTML content.. But still we are receiving the error.
Any advice how to fix this issuer would be nice.
Here is code that we are using for neutralizing the log message before it is passed to NLog:
public static string Neutralize(this string str, string with = "@", bool escapeHtml = true) {
if (str != null) {
if (escapeHtml) {
str = System.Security.SecurityElement.Escape(str);
}
return str
.Replace("\n", with)
.Replace("\r", with);
}
return string.Empty;
}
The method is a extension method for string class. Here is a code how it is used in actual log method:
private void Log(LogLevel level, string message, params object[] arguments) {
try {
if (m_Logger.IsEnabled(level)) {
message = string.Format(message, arguments);
m_Logger.Log(level, message.Neutralize());
}
} catch (FormatException) {
#if DEBUG
throw;
}
}
Is the VeraCode scanner smart enough to detect that neutralization code is..outside the actual log method?
Cheers!
-kimmo
.png){kind=logo}
Hi @KLaine375720 (Community Member) ,
The Veracode static scanner should be able to detect usage of System.Security.SecurityElement.Escape to remediate CWE 117 or other supported cleansing function like it that is listed in our Help Center: https://help.veracode.com/r/review_cleansers . It's possible that there is something specific to your implementation or code that is preventing the scanner to identify the cleanser.
I would recommend you contact our technical support team. Here's how you can log a case:
1. Navigate to the upper right corner of any page in the Community, click on your user avatar.
2. Select Contact Support from the drop-down menu.
If you can provide the team specifics about your application/scan and flaw IDs, they can investigate what might've happened and provide additional guidance if applicable.
Thanks,
Veasna Nhin
Senior Application Security Consultant
Thank you, contacted support.
-k