JBaker213009 (Community Member) asked a question.
What is the correct way to fix CRLF injection (CWE-117) flaws in an Android application?
I have several CRLF injection flaws that are showing up when I scan my Android application. I am removing all new line and carriage returns from all strings logged. I also tried some functions on the "approved cleaner" list and none of these removed the flaw. Is there a approved function that will escape malicious log injection from user input that I can use in android?
.png){kind=logo}
Hi @JBaker213009 (Community Member) ,
Veracode Static Analysis detects CWE-117: Improper Output Neutralization for Logs when it can see input from an untrusted source (such as user input, but also files or webservice input) going into a logging statement.
We recommend using one of our supported cleansing functions listed at: https://help.veracode.com/r/review_cleansers . An example of this specifically for Android is: android.net.Uri.encode .
If after recompiling and rescanning with Veracode Static Analysis the flaw is not automatically closed I would recommend you contact our technical support team. Here's how you can log a case:
1. Navigate to the upper right corner of any page in the Community, click on your user avatar.
2. Select Contact Support from the drop-down menu.
In this please provide a link to your results in the Veracode Platform and the flaw id.
Thank you,
Boy Baukema