SBorra759560 (Community Member) asked a question.
I have tried several fixes for CWE 73 issue including the validation method with "FilePathCleanser" decorator. No solution is able to remove the issue from scan results. Is there any other solution that we can try ?
If there is no other solution to the fix and mitigation is the only option, Is there any way to make sure that mitigated issues wont appear in the fresh scan again as new issues.
.png){kind=logo}
Hi @SBorra759560 (Community Member) ,
Veracode Static Analysis will only accept as remediated the hardcoding of all path components. Any other solution (for example the solutions listed at https://community.veracode.com/s/article/how-do-i-fix-cwe-73-external-control-of-file-name-or-path-in-java ) must be manually reviewed through the mitigation proposal mechanism ( https://help.veracode.com/r/improve_mitigation ).
The FilePath Custom Cleanser ( https://help.veracode.com/r/customcleansers ) attribute/annotation only automates (part) of this mitigation.
Please note though that mitigated flaws should stay mitigated in new scans, if they do not I would recommend you schedule a consultation call to discuss.
You can check out this knowledge article (https://community.veracode.com/s/article/How-to-schedule-a-consultation-call) on how to schedule a consultation call with us.
Thank you,
Boy Baukema