DBaffour435534 (Community Member) asked a question.
CWE 117
Hi, Quick question -
I have addressed the CWE117 flaw by writing a custom method to strip out the carriage returns and line feed etc, but this flaw is still being reported in our reports.
Will this flaw be eliminated if I use another alternative supported cleaners such as AntiXss.HtmlEncode rather than the EASPI library?
With regards
Dennis.
.png){kind=logo}
Hi @DBaffour435534 (Community Member)
CWE 117 is flagged on logging statements ( for e.g. log.info(), log.warn(), etc), Here the attacker has the possibility of inserting arbitrary logs into the log files.
If you have designed a custom cleanser method that removes all occurrences of CRLF characters like \n, \r, %0a, %0A, %0d, %0D, etc.
then it definitely helps to mitigate the flaw. But note that this is Mitigate By Design strategies and must be manually mitigated.
Alternatively, you can use one of the Supported cleansing functions (https://help.veracode.com/r/review_cleansers) for e.g. Microsoft.Security.Application.AntiXss.HtmlEncode that should automatically address CWE 117.
If you have any questions on this I would recommend scheduling a Consultation with a Veracode Application Security Consultant. You can find more on how to do this here: https://help.veracode.com/r/t_schedule_consultation
Regards,
Kashif
You can also annotate your custom cleansing function so that the static analyzer can automatically recognize it and automatically mark issues as mitigated. See this post for some more details on some options and some sample code for logging: https://community.veracode.com/s/question/0D52T000051MFILSA4/cwe117-mitigation-by-setting-encoding-on-logging-files-via-log4js-configuration
Hi Robert,
Thank you for sharing it, however, please note that Custom Cleansers must be enabled on an account level before they have any effect (Refer: https://help.veracode.com/reader/RXjxbTR2MDQdN3gX4l53CQ/qBpw6yXOpKGELy9APnDXIA )
Kindly check with your App Sec team before you start using Veracode Custom Cleansers.
Thank you,
Kashif