TScaria621837 (Community Member) asked a question.
How to solve CWE 1174 - ASP.NET Misconfiguration: Improper Model Validation in c#
Hi,
In the last scan we got too many CWE 1174 (Improper Model Validation) flaws in application.
This is one of the sample lines of code –
public string strLocation { get; set; }
public string XML { get; set; }
VeraCode scan raised CWE 1174 issue against these lines. The variable 'strLocation' not used in the application and 'XML' is used. But both lines shows the flaw.
Please suggest how to resolve these?
Thanks,
Jaisa Thomas
.png){kind=logo}
Hi @TScaria621837,
The reason Veracode Static Analysis reports CWE 1174 here is the lack of model data annotations, i.e. when it detects models without any validation whatsoever. We always recommend adding some validation (https://docs.microsoft.com/en-us/aspnet/core/mvc/models/validation?view=aspnetcore-5.0#validation-attributes), such as `[EmailAddress]` or `[CreditCard]`, if applicable. This makes sure that the input conforms with your expectations of its format. If no strict validation is possible, we recommend at the very least limiting the string length.
Adding any kind of validation here will make the flaws automatically disappear.
Thank you,
Florian Walter