HSrivastava325941 (Community Member) asked a question.
How to pass the path of the file in inputstream for Android app (Java). I am not getting proper solution for CWE 201.
If I am implemented CWEException its not working. If I am using FileInputStream its not working as well as if I am using SecurityException, its not working.
Can anyone tell me how to fix this.
try {
InputStream stream = activity.getContentResolver().openInputStream(uri);
if (stream != null) {
bitmap = BitmapFactory.decodeStream(stream, null, options);
stream.close();
}
} catch (FileNotFoundException e) {
Log.e(TAG, "Error opening image", e);
return null;
} catch (IOException e) {
Log.e(TAG, "Error closing stream", e);
return null;
}
.png){kind=logo}
Hi @HSrivastava325941 (Community Member) ,
Veracode Static Analysis reports CWE 201 (Insertion of Sensitive Information Into Sent Data) when it detects that potentially sensitive data is sent out of the application. The concerns being that the sent-out information might be sensitive in itself (such as credentials or private messages) or an attacker might be able to leverage the information for further attacks.
From the example it's not clear where CWE 201 is reported, but the most likely place is the 'uri' variable used for the InputStream. If that contains data from a sensitive location such as configuration, Veracode Static Analysis will report it for CWE 201.
The question we will ask is: Whether this data is really sensitive or not. The scanner might be wrongly identifying it but is basically giving us all an opportunity to review if we may be passing any sensitive data. The scanner usually refers to configuration or properties as "Sensitive", so it is best we review each of such properties used in the flagged code.
If there is no sensitive data, please feel free to propose mitigation (refer: https://help.veracode.com/r/improve_mitigation) by explaining which config or environmental variables are used and why you think they are not sensitive at all. If they are sensitive, ensure that the transfer of that sensitive data is intended and that it does not violate the application security policy. This flaw is categorized as low severity because it only impacts confidentiality, not integrity or availability.
If you still have questions I would recommend you schedule a consultation call to discuss.
You can check out this knowledge article (https://community.veracode.com/s/article/How-to-schedule-a-consultation-call) on how to schedule a consultation call with us.
Thank you,
Boy Baukema