See the code below that is being flagged on line "return builder.ConnectionString;". As you can see there is no chance anything is being controlled from external source, everything is hardcoded. Is there a way to avoid CWE 15 by using another approach to construct connection string, perhaps? Any ideas?

     private CustomerDbConfiguration ConnectionConfig

    {

      get

      {

        CustomerDbConfig org = new CustomerDbConfig();

        org.DatabaseName = "CustomerDB";

        org.DatabaseServer = "somedbname.database.windows.net";

        org.DatabaseUser = "username";

        org.DatabasePassword = "asjkdhashdaskdj!!!";

        org.UseWindowsAuthentication = false;

        return org;

      }

    }

    internal string GetOrganizationConnectionString()

    {

      SqlConnectionStringBuilder builder = new SqlConnectionStringBuilder();

      builder.DataSource = ConnectionConfig.DatabaseServer;

      builder.InitialCatalog = ConnectionConfig.DatabaseName;

      if (ConnectionConfig.UseWindowsAuthentication)

      {

        builder.IntegratedSecurity = true;

      }

      else

      {

        builder.IntegratedSecurity = false;

        builder.UserID = ConnectionConfig.DatabaseUser;

        builder.Password = ConnectionConfig.DatabasePassword;

      }

      builder.Pooling = true;

      builder.Enlist = false;

      return builder.ConnectionString;    

    }