JGe356144 (Community Member) asked a question.
CWE 1174 - ASP.NET Misconfiguration: Improper Model Validation issue on [FromService] binding.
I have a MVC action method like this:
public ActionResult Details([FromServices] IAnalyticsService analytics)
{
......
}
VeraCode scan raised CWE 1174 issue against the action method:
Description: The Controller's Action has a model that fails to perform Model Validation. This could expose the application to other weaknesses related to insufficient input validation.
Remediation: Be sure to check the ModelState.IsValid property in the Controller Action before using the data contained within the model.
Is there any meaning to call ModelState.IsValid in this case? Is this a false positive?
Thanks,
Jason
.png){kind=logo}
Hi Jason,
Veracode Static Analysis should not report CWE 1174 on an object injected from DI.
Please verify using the flaw details including the "Attack Vector" that this is the method being reported, if so please provide more details in a support case (including link to flaws in Veracode Platform and specific flaw id).
Here's how you can log a case:
1. Navigate to the upper right corner of any page in the Community, click on your user avatar.
2. Select Contact Support from the drop-down menu.
Thank you,
Boy Baukema
Following is the details:
Attack Vector: Details
Number of Modules Affected: 2
Description: The Controller's Action has a model that fails to perform Model Validation. This could expose the application to other weaknesses related to insufficient input validation.
Remediation: Be sure to check the ModelState.IsValid property in the Controller Action before using the data contained within the model. Note: This flaw used to be reported as CWE 100, which has been deprecated by MITRE.
It seems VeraCode scan is reporting on the DI injection.
Hi @JGe356144 (Community Member) ,
Jason very helpfully provided the details for his flaw in a support case and Veracode Engineering is reviewing it. I can confirm that for CWE 1174 we currently don't filter out objects from DI.
Please propose a 'Potential False Positive' mitigation on this flaw (more information here: https://help.veracode.com/r/improve_mitigation ) and have this proposal reviewed by your companies security team. Please also consider subscribing to our Product Updates at https://info.veracode.com/Subscription-Management.html to be notified of updates to Veracode Static Analysis.
Thank you,
Boy