JRaman655537 (Community Member) asked a question.
Hi,
I have following code in .NET WEB API Controller to do Depency Injection to have my other service components (Data Access, Mapper and Logger) - based on https://docs.microsoft.com/en-us/aspnet/web-api/overview/advanced/dependency-injection
public class ReservationController : ApiController
{
private readonly IAppRepository _repository;
private readonly IMapper _mapper;
private readonly ILogger _logger;
//Constructor with Dependency Injection
public ReservationController(IAppRepository repository, IMapper mapper, ILogger logger)
{
_repository = repository;
_mapper = mapper;
_logger = logger;
}
Veracode is complaining about
public ReservationController(IAppRepository repository, IMapper mapper, ILogger logger)
as CWE 1174 ASP.NET Misconfiguration: Improper Model Validation.
It is a overloaded constructor method of my API Controller, what kind of Route Attribute I can define for a Constructor, can you help to solve this issue. Thanks!
.png){kind=logo}
I believe error location was misleading. Though it was reporting the error in the constructor, Issue was with HTTP put/get/post method declarations, we need to apply Route Constraints with attributes.
Here is the fix
Original code:
[Route("{user}/{startDate}/{endDate}")]
public async Task<IHttpActionResult> GetReservationsByUserAndDate(string user, DateTime startDate, DateTime endDate)
New code:
[Route("{user:maxlength(100)}/{startDate:datetime}/{endDate:datetime}")]
public async Task<IHttpActionResult> GetReservationsByUserAndDate([FromUri] string user, [FromUri] DateTime startDate, [FromUri] DateTime endDate)
Old code:
[Route("{id}")]
[HttpPut]
public async Task<IHttpActionResult> UpdateEquipment(long id, EquipmentDTO equipment)
New code:
[Route("{id:long}")]
public async Task<IHttpActionResult> UpdateEquipment([FromUri] long id, [FromBody] EquipmentDTO equipment)
Just wanted to share, this is how I have fixed the issue, Though Veracode was reporting the error in the constructor, Issue was with HTTP put/get/post method declarations, we need to apply Route Constraints with attributes.
OLD code (had issue):
[Route("{user}/{startDate}/{endDate}")]
public async Task<IHttpActionResult> GetReservationsByUserAndDate(string user, DateTime startDate, DateTime endDate)
NEW CODE (to Fix):
[Route("{user:maxlength(100)}/{startDate:datetime}/{endDate:datetime}")]
public async Task<IHttpActionResult> GetReservationsByUserAndDate([FromUri] string user, [FromUri] DateTime startDate, [FromUri] DateTime endDate)