VBhachu185585 (Community Member) asked a question.
CWE id 201 | Insertion of Sensitive Information Into Sent Data | 1 flaw
How to fix the insertion os sensitive information into sent data flaw for response object.
MultivaluedMap<String, Object> headers = new MultivaluedHashMap<>();
headers.add(LambdaConstant.CONTENT_TYPE, MediaType.APPLICATION_JSON);
headers.add(LambdaConstant.X_INSERT_KEY, LambdaConstant.NEW_RELIC_INSERT_KEY);
// CWE 201 flaw starts here
Response response = restClient.target(LambdaConstant.NEW_RELIC_URL)
.request(MediaType.TEXT_PLAIN)
.headers(headers)
.post(Entity.text(OBJECT_MAPPER.writeValueAsString(newRelicStats)));
.png){kind=logo}
Hi @VBhachu185585 (Community Member)
CWE 201 is flagged usually when the scanner believes that one of the potentially sensitive data is being transferred out of the application.
The question we will ask is: Whether this data is really sensitive or not. The scanner might be wrongly identifying it but is basically giving us all an opportunity to review if we may be passing any sensitive data. The scanner usually refers to configuration or properties as "Sensitive", so it is best we review each of such properties used in the flagged code.
If there is no sensitive data, please feel free to propose mitigation (refer: https://help.veracode.com/r/improve_mitigation) by explaining which config or environmental variables are used and why you think they are not sensitive at all. If they are sensitive, ensure that the transfer of that sensitive data is intended and that it does not violate the application security policy. This flaw is categorized as low severity because it only impacts confidentiality, not integrity or availability.
If you still have questions I would recommend you schedule a consultation call to discuss.
You can check out this knowledge article (https://community.veracode.com/s/article/How-to-schedule-a-consultation-call) on how to schedule a consultation call with us.
Regards,
Kashif Syed