BScarboro644374 (Community Member) asked a question.
Does NLog's ${replace-newlines} layout renderer fix CWE ID 117?
I've been able to use that layout renderer to successfully replace CRLFs with underscores, which seems like it addresses the concern in CWE 117. Is that correct?
And then whether or not a subsequent scan will recognize that as fixed is a separate question.
Thanks for any tips!
.png){kind=logo}
Hi @BScarboro644374 (Community Member) ,
Yes, replacing CRLF characters does address the concern here and would make it a suitable candidate for a mitigation by design. Veracode Static Analysis is only able to automatically detect your sanitization if it uses one of our supported cleansing functions (https://docs.veracode.com/r/review_cleansers). For more information on how to propose a mitigation, please refer to our Help Center: https://docs.veracode.com/r/improve_mitigation.
I would recommend a slight adjustment to your approach. Instead of replacing CRLF characters with underscores, it might be a better idea to escape them by pre-pending a backslash. This would make sure that you can still see if someone tries to mess with your log files (i.e. preserving intend for auditing) without actually allowing them to do it. For more information on how to deal with CWE 117, please refer to the following article: https://community.veracode.com/s/article/How-to-Fix-CWE-117-Improper-Output-Neutralization-for-Logs
Thank you,
Florian Walter