vpopescu (Community Member) asked a question.
I am trying to fix some CWE 117 when writing a string using Serilog (Net Core). This is an input parameter on a web service method. Th following is the abstracted code:
using System;
// the validation function
private static bool IsValidString(string str)
{
if (string.IsNullOrEmpty(str))
return false;
if (str.Length > 10)
return false;
for (int sl = 0; sl < str.Length; sl++) {
if (!((str[sl] >= 'a' && str[t] <= 'z') ||
(str[sl] >= 'A' && str[sl] <= 'Z') ||
(str[sl] >= '0' && str[sl] <= '9'))) return false ;
}
return true;
}
// the caller
public async Task<IActionResult> myMethod(string str) {
if (!IsValidString(q))
return(some http error):
myLogger.LogDebug("string passed: {0}", str); <-- causes CWE 117
}
The error still continues. Am i misreading CWE 117?
.png){kind=logo}
Hi @vpopescu (Community Member),
Veracode Static Analysis reports CWE 117 (Improper Output Neutralization for Logs) when it can detect that log messages are composed using data from outside the application (such as the HTTP request, the files system, or even the database). The concern is that if an attacker would be able to inject CRLF characters (i.e. newline characters) they would be able to inject their own log entries into your app. This may render your log files useless for auditing purposes as you don't know which log entries come from your app and which from an attacker.
We recommend using one of our supported cleansing functions for CWE 117, which would remediate any risk and make the flaw automatically disappear. Validation like yours, which checks if a string is alphanumeric, would be a good mitigation strategy in scenarios where remediation is not possible but not something our Static Engine would be able to automatically detect. In such a scenario I would recommend using a regular expression to improve readability. In your case, something like this should work: `^[a-zA-Z0-9]{1,10}$` (without the ticks).
Thank you,
Florian Walter