MaheshBabu (Community Member) asked a question.
The program fails to release or incorrectly releases the variable _connection, which was previously allocated by a call to system_data_dll.System.Data.SqlClient.SqlConnection.!newinit_0_0().
private global::System.Data.SqlClient.SqlConnection _connection;
internal global::System.Data.SqlClient.SqlConnection Connection {
get {
if ((this._connection == null)) {
this.InitConnection();
}
return this._connection;
}
set {
this._connection = value;
if ((this.Adapter.InsertCommand != null)) {
this.Adapter.InsertCommand.Connection = value;
}
if ((this.Adapter.DeleteCommand != null)) {
this.Adapter.DeleteCommand.Connection = value;
}
if ((this.Adapter.UpdateCommand != null)) {
this.Adapter.UpdateCommand.Connection = value;
}
for (int i = 0; (i < this.CommandCollection.Length); i = (i + 1)) {
if ((this.CommandCollection[i] != null)) {
((global::System.Data.SqlClient.SqlCommand)(this.CommandCollection[i])).Connection = value;
}
}
}
}
private void InitConnection() {
this._connection = new global::System.Data.SqlClient.SqlConnection();
this._connection.ConnectionString = System.Configuration.ConfigurationManager.ConnectionStrings["PortalConnectionString"].ConnectionString;
}
The issue is this code - "this._connection = new global::System.Data.SqlClient.SqlConnection();" under portaldataset.designer.cs Line# 3909 I try to fix this reference link - https://cwe.mitre.org/data/definitions/404.html in C# example to Open the connection & close the connection But also it's not fixing the Veracode Scan Report. Kindly let us know about this issue ASAP.
.png){kind=logo}
Hi @MaheshBabu (Community Member) ,
Veracode Static Analysis detects flaws of CWE-404: Improper Resource Shutdown or Release when it can see that a resource is initialised, but Dispose is not called.
The security risk with this is that an attacker may perform a denial of service by triggering this functionality multiple times, causing resource exhaustion.
Typically with C#.NET we recommend use of the 'using statement' ( https://docs.microsoft.com/en-us/dotnet/csharp/language-reference/keywords/using-statement ) to ensure a resource is Disposed after use. This can be automatically verified by Veracode Static Analysis.
However, in this instance it appears that this class is managing an instance and providing it to other classes.
Please verify that "initConnection" is only called once during the application lifetime, document this using a mitigation proposal ( https://help.veracode.com/r/improve_mitigation ) and contact your organizations security team for a manual review.
Thank you,
Boy Baukema