AJoiner553213 (Community Member) asked a question.
How can this newly created empty string be tainted? Veracode is calling this out as a CWE-89.
var sql = new StringBuilder();
TestTaint(sql.ToString());
TestTaint(string sql) calls system_data_dll.System.Data.Common.DbCommand.ExecuteScalarAsync
Veracode says:
Attack Vector: system_data_dll.System.Data.Common.DbCommand.ExecuteScalarAsync
Number of Modules Affected: 1
This database query contains a SQL injection flaw. The call to system_data_dll.System.Data.Common.DbCommand.ExecuteScalarAsync() constructs a dynamic SQL query using a variable derived from untrusted input. An attacker could exploit this flaw to execute arbitrary SQL queries against the database. ExecuteScalarAsync() was called on an object, which contains tainted data. The tainted data originated from an earlier call to system_data_dll.System.Data.Common.DbCommand.ExecuteReader.
.png){kind=logo}
I got an answer from OPS:
That taint is propagating to the instance of (my class), and since TestTaint() is a private method on that class, the (database façade) within it is considered tainted.
Note that the flaw went away when I passed the sql object through a cleanser immediately after creating the object. It seems that the owning method may have been considered tainted, so any objects created within the method inherit the taint.