Hi @JGe356144 (Community Member)​ ,

Great question! Once the custom cleanser feature is enabled for your account, the Security Lead or Veracode Administrator will need to decide on what should happen when the Veracode Platform sees a Veracode Annotation within your application scan. Here are the 3 possible options:

1. None - This is the default setting when the feature is enabled by Veracode. The Veracode Platform will do nothing if it sees a Veracode Annotation in your code.
2. Propose - This is the most common option among our customer base. The Veracode Platform will auto-propose a mitigation for the flaw class reported by the Veracode Static Analysis Tool. The flaw reported will have a mitigation status of propose and if you expand on the flaw details, you will see "Proposed by Custom Cleanser Function" with comments stating cleansing method with the Veracode Annotation.
3. Approve - This is not recommended and should be carefully discussed/reviewed before enabling. The Veracode Platform will auto-propose a mitigation as well as auto-approve the mitigation for the flaw class reported by the Veracode Static Analysis Tool without any review or acknowledgment of the mitigating controls.  

For more information on custom cleansers, please review https://community.veracode.com/s/article/How-To-Use-Custom-Cleanser .

Based on your description, either the default setting of "None" is still in place for your account or you might already find some auto-proposed mitigations for these flaws, which need to be approved by your security team for the flaw to not affect your policy anymore.

Thank you,

Florian Walter

Hi, Florian,

Thanks for the reply. Yes, they are in the proposed state. However, the code I put in should solve the issue, not only propose the mitigation.

WebUtility.HtmlEncode() is VeraCode approved cleanser method for log. I also removed the \n and \r in the message writing to the log. I expected VeraCode scan recognized the code and remove the issues.

Thanks,

Jason

Hi Florian,

We are thinking of creating the set of 100% effective custom cleansers for Redirect , 117 Log cleaning and get that reviewed by our security team and then get a 3. Approve settings so that we don't need to worry during each code change. Just imagine a line is changed on a controller and all the mitigated issues has to be readdressed!

So we are looking to get an method which will satisfy the scanner and ensure the 117 threat is properly addressed. We tried extension methods and we were told the scanner may not detect it , so created the direct method and use it every where we need to log entry which has a user input. What else needs to be changed?

/// <summary>

    /// This string extension is used to remove line feeds and encode HTML, Used to log - mitigate CWE ID 117

    /// </summary>

    /// <param name="logentry">string to be logged</param>

    /// <returns>cleaned string</returns>

    [CRLFCleanser]

    public static string SanitizeLogEntry(this string logentry)

    {

      logentry = logentry.Replace(Environment.NewLine, "New Line Feed removed");

      return WebUtility.HtmlEncode(HttpUtility.UrlEncode(logentry));

    }

    /// <summary>

    /// This function extension is used to remove line feeds and encode HTML, Used to log - mitigate CWE ID 117

    /// </summary>

    /// <param name="logentry">string to be logged</param>

    /// <returns>cleaned string</returns>

    [CRLFCleanser]

    public static string Sanitize(string logentry)

    {

      logentry = logentry.Replace(Environment.NewLine, "New Line Feed removed");

      return WebUtility.HtmlEncode(HttpUtility.UrlEncode(logentry));

    }

Add the the above situation - inconsistent scan behavior noticed.

 public static class CustomCleanserExtensions

  {

    /// <summary>

    /// This string extension is used to remove line feeds and encode HTML, Used to log - mitigate CWE ID 117

    /// </summary>

    /// <param name="logentry">string to be logged</param>

    /// <returns>cleaned string</returns>

    [CRLFCleanser]

    public static string SanitizeLogEntry(this string logentry)

    {

      logentry = logentry.Replace(Environment.NewLine, "New Line Feed removed");

      return WebUtility.HtmlEncode(HttpUtility.UrlEncode(logentry));

    }

    /// <summary>

    /// This function extension is used to remove line feeds and encode HTML, Used to log - mitigate CWE ID 117

    /// </summary>

    /// <param name="logentry">string to be logged</param>

    /// <returns>cleaned string</returns>

    [CRLFCleanser]

    public static string Sanitize(string logentry)

    {

      logentry = logentry.Replace(Environment.NewLine, "New Line Feed removed");

      return WebUtility.HtmlEncode(HttpUtility.UrlEncode(logentry));

    }

}

Scanner didn't pick up this as Mitigation status = Proposed - extension method not detected.

 _logger.LogError(message, HttpUtility.UrlEncode($"Unable to send SMS to {model.MobileNumber.SanitizeLogEntry()} for {model.UserName.SanitizeLogEntry()}"), null);

Scanner picked up this as Mitigation status = Proposed.

 _logger.LogError(e, $"Profile Error for: {CustomCleanserExtensions.Sanitize(model.UserName)}", null);