RRoy Moulick393155 (Community Member) asked a question.
Hello All,
I am using org.apache.commons.csv.CSVPrinter to print some String values in my code. Veracode detected CWE 1236 flaw in csvprinter.print(mystring) this line during static scan.
As per my understanding about this issue I have already tried with StringUtils.stripStart(mystring, "=+-@\\r\\t") and then used that updated mystring value in the csvprinter.print statement. But veracode is still showing the same issue on the same line.
I just want to clean this flaw from the veracode perspective without hampering the existing functionality.
Could anybody please suggest me some solutions on this. Is there any list of veracode cleansing functions present for JAVA to resolve this flaw?
Thanks,
Ritesh
.png){kind=logo}
Hi All,
I got a solution like prepending single quote (') character before the value starting with special characters like (=,+,@,-, tab character, carriage return character etc.) so that those formula elements will not be executed when we try to open/view those over spreadsheet.
So, I have tried with the below code, still veracode static rescan report is flagging the same issue in the same location as earlier.
Pattern p = Pattern.compile("^([+\r\t-@=])");
Matcher m = p.matcher(mystring);
printer.print((m.find()) ? "\'" + mystring + "\'" : mystring);
I am not able to find any java code solution for this flaw, which can clean the veracode platform without disturbing the existing functionality.
Could anyone please suggest something on this. Still sticking with the same issue.
Regards,
Ritesh
Hi @RRoy Moulick393155 (Community Member) ,
Veracode Static Analysis detects CWE-1236: Improper Neutralization of Formula Elements in a CSV File when it can see that data from outside of the application (for example from a users HTTP request, but also from a file, database or webservice) is going into a CSV file.
Currently, no supported cleansing functions ( https://help.veracode.com/r/review_cleansers ) are supported for this flaw category.
We recommend following the guidance from OWASP: https://owasp.org/www-community/attacks/CSV_Injection, documenting this in a mitigation statement ( https://help.veracode.com/r/improve_mitigation ) and requesting a manual review from your security team.
Please let me know if you have any remaining questions or concerns.
Thank you,
Boy Baukema
Hi Community
We came accross the same issue.
Veracode tells this code has CWE-1236 (Improper Neutralization of Formula Elements in a CSV File) flaws on each printer.print(...) call:
```
CSVPrinter printer = new CSVPrinter(...);
for (PartyExtendedDto partyDto : partiesSorted) {
printer.print(onlyAllowAlphaNumeric(partyDto.getSystemOfRecord()));
printer.print(preventFormulaInjection(partyDto.getSystemOfRecord()));
printer.print(prependQuoteChar(partyDto.getSystemOfRecord()));
}
```
I created three different methods to solve the CWE-1236. Each followed a different advice, but non of them gets accepted by VeraCode.
```
import org.owasp.encoder.Encode;
import static java.util.regex.Pattern.matches;
public class CSVOutputEscaper {
static final String FORMULA_INJECTION_REGEX = "^[=+\\-@\\u0009\\u000D].*$";
static final String ALPHA_NUMERIC_REGEX = "^[a-zA-Z0-9]+$";
private CSVOutputEscaper() {
}
/**
* Wrap each cell field in double quotes
* Prepend each cell field with a single quote
* Escape every double quote using an additional double quote
* Source: https://owasp.org/www-community/attacks/CSV_Injection
*/
public static String preventFormulaInjection(String data) {
data = data.replace("\"", "\"\"");
if (matches(FORMULA_INJECTION_REGEX, data)) {
data = "'" + data;
}
return Encode.forHtml(data);
}
/**
* If the exported data can be limited to letters, numbers and decimal separator, consider filtering the data to remove all characters that are not allowed.
* Source: VeraCode static scan display_text.
*/
public static String onlyAllowAlphaNumeric(String data) {
return matches(ALPHA_NUMERIC_REGEX, data) ? Encode.forHtml(data) : "Redacted because data included non alphanumeric characters";
}
/**
* If a field starts with a formula character, prepend it with a ' (single apostrophe), which prevents Excel from executing the formula
* Source: https://cwe.mitre.org/data/definitions/1236.html -> Potential Mitigation
*/
public static String prependQuoteChar(String data) {
return Encode.forHtml("'" + data);
}
}
```
What can I do that VeraCode accepts my mitigations?