GMangal803444 (Community Member) asked a question.
How to fix CWE-15 issue getting at AWS SNS service call
We are using AWS SNS service to send push notifications to the devices and we scanned that code and veracode reported CWE-15 issue at the below part of code. We were getting this issue before but it was fixed by Encode.forHtmlContent() and this code is still there in code but now its reported again. Please assist me to fix this issue.
PublishRequest request = new PublishRequest();
request .setMessageStructure("json");
request .setTargetArn(Encode.forHtmlContent(arn)); //This data is coming from database
request .setMessage(Encode.forHtmlContent(msg)); //This data is coming from database
result = amazonSNSClient.publish(request); //Getting CWE-15 issue at this line
.png){kind=logo}
Hi @GMangal803444 (Community Member)
CWE 15 is flagged for when we see that one or more settings are originating from untrusted sources for e.g. in this case TargetArn and Message retrieved from the database. Note that SAST believes that DB is one such untrusted source.
If you still have questions I would recommend you schedule a consultation call to discuss.
You can check out this knowledge article (https://community.veracode.com/s/article/How-to-schedule-a-consultation-call) on how to schedule a consultation call with us.
Regards,
Kashif
I have the same problem, I did the validations but the problem persists