mkulkarni005097 (Community Member) asked a question.
CEW 73 - How to fix flaws of the type CWE 73 External Control of File Name or Path with the method of getQueryString HttpServletRequest(java)
Hi Team, I am retrieving Query String from the HttpServletRquest (in Java).
String QueryParameters = httpServletRequest.getQueryString();
Veracode consider this as a flaw,
I tried to validate this query string with Recommended OWASP ESAPI Validator methods, but none of them is working and the scan still identifies it as a flaw.
example :
String QueryParameters = ESAPI.validator().getValidInput("Page",httpServletRequest.getQueryString(),"QueryStringRegEx",false);
QueryStringRegEx is the Regular Expression against which QueryString is getting validated
.png){kind=logo}
Hi @mkulkarni005097 (Community Member)
The httpServletRequest.getQueryString(); returns the query string that is contained in the request URL after the path for e.g. username=u1001&password=hello123; here this string is Query parameters 'username' and 'pwd' which can be retireved using request.getParameter().
The entire string is considered untrusted as it can be anytime manipulated by an attacker.
As you suggesting this is flagged for CWE 73, I wonder how exactly have you used the entire query as in case it may contain multiple parameters.
any which case, we are required to validate the 'filename' or 'file path variable used in File reading/writing object initialization.
Having an EASPI validator validating using the regex might not be sufficient in mitigating the risk of CWE 73.
Please refer to this article it helps and suggests a variety of mitigation strategies that can be combinedly implemented to reduce the overall risk of CWE 73.
If you still have questions I would recommend you schedule a consultation call to discuss.
Refer : https://community.veracode.com/s/article/how-do-i-fix-cwe-73-external-control-of-file-name-or-path-in-java
You can check out this knowledge article (https://community.veracode.com/s/article/How-to-schedule-a-consultation-call) on how to schedule a consultation call with us.
Regards,
Kashif