MSkidmore454594 (Community Member) asked a question.
I have statements like this in my code:
`if (debug) console.log("Got file of length " + file.byteLength);`
and Veracode is reporting this as a CWE ID 117 flaw. Is CWE ID 117 intended for logging to the console?
Ask the Community
Get answers, share a use case, discuss your favorite features, or get input from the community.
By clicking “Accept All Cookies”, you agree to the storing of cookies on your device to enhance site navigation, analyze site usage, and assist in our marketing efforts.
.png){kind=logo}
These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the site will not then work. These cookies do not store any personally identifiable information.
These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site. All information these cookies collect is aggregated and therefore anonymous. If you do not allow these cookies we will not know when you have visited our site, and will not be able to monitor its performance.
These cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.
Hi @MSkidmore454594 (Community Member)
CWE 117 (https://cwe.mitre.org/data/definitions/117.html) concerns the Log forging attack. It is flagged by the scanner whenever it finds a logging statement using some variables derived from untrusted sources. The application code does incorrectly neutralizes output that is written to logs.
Please make sure the variables are cleansed for CRLF characters before concatenating with other hard-coded parts of the logging statement.
Highly recommend using the supported cleansing functions from https://help.veracode.com/r/review_cleansers.
Select the functions which address CWE 117 in particular.
Alternatively, you can implement a CRLF cleanser, which filters out CRLF characters like (\n, \r, %0a, %0A, %0D, %0d ) from those variables. [A method that accepts a String and returns a String by replacing all the CRLF characters from it]. But with that approach, you will have to manually raise 'Mitigate By Design' proposals.
Regards,
Kashif
Hi @MSkidmore454594 (Community Member) ,
To add onto what @Kashif, Security Consultant (Veracode inc) mentioned. console.log will typically be used in 2 contexts. in the client side JS in a browser like Chrome or server-side in a runtime like Node.JS. But can also be used for example in the browser but also captured to a server side process.
Veracode Static Analysis is unable to determine the context of a logging statement (indeed with modern practices like isomorphic JavaScript it may be impossible to determine unless at runtime).
In general we recommend ensuring that an attacker will not be able to add log lines to any line delimited log file by ensuring that the data being logged does not have new lines. You can do this by removing newlines as @Kashif, Security Consultant (Veracode inc) mentioned but also by using a dataformat that simply does not have newlines like a Number:
console.log("Got file of length " + +file.byteLength);
Thank you,
Boy Baukema
Thank you @Kashif, Security Consultant (Veracode inc) and @Boy, Security Consultant (Veracode) .
However, Veracode provides a list of supported cleansing functions here: https://help.veracode.com/r/review_cleansers
I don't see any JavaScript functions there.
Is Veracode going to accept any home-baked newline filtering function that I make?
HI @peterdevpl (Community Member) ,
Unfortunately, Veracode Research has not been able to discover any properly implemented and broadly supported functions. If you have any ideas on this please consider registering them with Veracode Community Ideas at https://community.veracode.com/s/ideas .
Veracode Static Analysis does automatically close flaws based on custom functions. You will need to document its use in a mitigation proposal ( https://help.veracode.com/r/improve_mitigation ) and have it manually reviewed by a member of your security team.
Thank you,
Boy Baukema