VeraCode static scan reports the CWE 404 issue:

Attack Vector: system_runtime_extensions_dll.System.IO.MemoryStream.!newinit_0_0

Number of Modules Affected: 1

Description: The program fails to release or incorrectly releases the variable <memoryStream>5__4, which was previously allocated by a call to system_runtime_extensions_dll.System.IO.MemoryStream.!newinit_0_0().

Remediation: Ensure that all code paths properly release this resource.

The code snippet is as following. We already has the using statement on the memory stream, but VeraCode scan still flag the CWE 404 on that line. Based on my past experience, VeraCode scan engine seems have difficult to recognize the using statement against MemoryStream in C#. We have several applications that report the same issue. All related to MemoryStream.

    public async Task<ActionResult> GetReport(DateTime start, DateTime end)

    {

      var results = await _service.GetReport(start, end);

      byte[] data;

      using (var memoryStream = new MemoryStream())

      using (var streamWriter = new StreamWriter(memoryStream, System.Text.Encoding.GetEncoding("iso-8859-1")))

      using (var csvWriter = new CsvWriter(streamWriter, CultureInfo.InvariantCulture))

      {

        csvWriter.Configuration.TypeConverterCache.AddConverter<bool>(new CsvBooleanConverter());

        await csvWriter.WriteRecordsAsync(results);

        streamWriter.Flush();

        memoryStream.Position = 0;

        data = memoryStream.ToArray();

      }

      return File(data, "text/csv", $"Report-{start:yyyy-MM-dd}-to-{end:yyyy-MM-dd}.csv");

    }

Please advise if the above code has any issues. Thanks.