When you visit any website, it may store or retrieve information on your browser, mostly in the form of cookies. This information might be about you, your preferences or your device and is mostly used to make the site work as you expect it to. The information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies. Click on the different category headings to find out more and change our default settings. However, blocking some types of cookies may impact your experience of the site and the services we are able to offer.
More information
.png){kind=logo}
Veracode Static Analysis reports flaws of CWE-201: Insertion of Sensitive Information Into Sent Data when it can detect that sensitive data (such as from configuration) is going into outgoing network traffic (for example an email or HTTP request).
The risk is that if sensitive data is incorrectly used this may lead to leakage of information.
Storing data in the database should not result in a CWE 201 flaw, this may mean Veracode Static Analysis is unable to see that this data is going to a database (rather than, say, to an HTTP Response).
I would recommend you schedule a consultation call to discuss.
You can check out this knowledge article (https://community.veracode.com/s/article/How-to-schedule-a-consultation-call) on how to schedule a consultation call with us.
Thank you,
Boy Baukema
var values = new System.Collections.Specialized.NameValueCollection()
{
{ "Grant_Type", "password" },
{ "Username", HttpUtility.HtmlEncode(KEY) },
{ "Password", HttpUtility.HtmlEncode(PASSWORD) }
};
Will this fix works? HttpUtility.HtmlEncode each data sent out.
No, HTMLEncoding is not supported (or recommended) for CWE 201 as the issue is not lack of encoding but sensitive information being sent out.