Hi @User16188492502227878163 (Community Member)​,

Veracode Static Analysis reports CWE 73 (External Control of File Name or Path) when it can detect that data coming from outside the application, such as an HTTP request, a file, or even your database, is being used to access a file path. The concern is that an attacker might be able to manipulate the file path and e.g. access or delete arbitrary files. Please refer to this knowledge article on how to deal with this CWE: https://community.veracode.com/s/article/how-do-i-fix-cwe-73-external-control-of-file-name-or-path-in-java

Thank you,

Florian Walter

@User16188492502227878163 (Community Member)​ 

Without knowing more about your particular use case, it is impossible to give customized advice. The only way that would make Veracode Static Analysis automatically close CWE 73 is using hardcoded values or validation of the input against an allow-list of hardcoded values. If that is not possible, we recommend dynamic validation of inputs using regular expressions or, in more complex cases, canonicalizing the input to validate the whole path.

The advice is the same for Java and .NET, and the Community article I shared earlier also has a C#.NET example. Moreover, we have a whole page describing how to deal with CWE 73 in .NET here: https://www.veracode.com/security/dotnet/cwe-73 .

Thank you,

Florian Walter

Hi,

{

 string fname= System.IO.Path.GetFileName(Request.Files["xyz"].FileName);

if (fileExtension == ".csv")

          {

            fileLocation = Server.MapPath(ConfigKeys.xyz) + Path.GetFileName(fname);

          }

 if (System.IO.File.Exists(fileLocation))

          {             

            System.IO.File.Delete(fileLocation);

          }

          Request.Files["bsy"].SaveAs(fileLocation);

System.IO.File.Copy(fileLocation, extrnfl, true);

}

here is my code something like this here at line no System.IO.File.Copy(fileLocation, extrnfl, true); also I am getting same flaw. Please help.

Hi @User16188492502227878163 (Community Member)​ ,

The variable `fileLocation` consists of 2 dynamic parts, `ConfigKeys.xyz` and `fname`. While the former appears to come from a config file and might be reasonably safe in a locked-down environment, the latter comes from the request and certainly needs strong validation. If your use case only allows a set of possible file names, I recommend creating an allow-list and validating that `fname` is one of these values. Otherwise, I recommend applying dynamic validation in form of a regex. Ideally, you would validate that `fname` is alphanumeric if that is applicable to your use case. A possible regex for this would be "^[a-zA-Z0-9]{1,50}$" (without the double quotes). This regex allows between 1 and 50 alphanumeric characters.

Please note that the only remediation Veracode Static Analysis accepts for CWE 73 is a hardcoded path or validation against a strict allow-list. This means that, once proper validation is in place, you may need to propose a mitigation (https://help.veracode.com/r/improve_mitigation) and contact your security team for mitigation review.

Thank you,

Florian Walter