If a supported cleansing function is not automatically closing the flaw I would recommend reviewing the following:

1. Does all data flow through the cleansing function? We sometimes find exception handling returning the original (tainted) data.
2. Are you not reusing a variable which also contains tainted data? For example: var username = request.parameter["username"]; username = supportedCleanser(username}; may confuse our engine under some conditions.
3. Is the DLL freshly compiled, included with your fixes? Optionally you can manually publish your solution and inspect the published DLL with a tool such as IL Spy.

If all of these are true I would recommend you contact our technical support team. Here's how you can log a case:

1. Navigate to the upper right corner of any page in the Community, click on your user avatar.

2. Select Contact Support from the drop-down menu.

In your case please provide a link to the results in the Veracode Platform with the relevant flaw ids.

Thank you,

Boy Baukema