RStock596849 (Community Member) asked a question.
Worked Example fixing CWE 117 in C#
Hopefully someone can provide a link to an example in C# of how to stop Veracode complaining about CWE 117. We understand the nature of the CWE 117, have implemented the documented cleansing function, stepped through the implementation debug and verified the sanitisation does occur before writing to logs. When re-scanning in Veracode it still reports the same flaws.
I've read through a lot of similar comments on here about solutions still being flagged as flaws but most threads don't post the final solution.
I'd really appreciate if anyone has a worked solution C# that resolved Veracode flagged flaws they could share.
~Many Thanks
Richard
.png){kind=logo}
Hi @RStock596849 (Community Member) ,
I hope this Knowledge Article helps: https://community.veracode.com/s/article/How-to-Fix-CWE-117-Improper-Output-Neutralization-for-Logs
Thank you,
Florian Walter
TLDR: For CWE 117 to automatically disappear from your Veracode report, you would have to apply encoding on all potentially untrusted variables (e.g. data coming from the HTTP request, the database or the file system) before inserting them into a log message. Veracode provides a list of "blessed" cleansing functions (https://docs.veracode.com/r/review_cleansers) and the CWE they are appropriate for. Any of these for CWE 117 would do the job.
Thanks @Florian, Security Consultant (Veracode) . Will read the links in detail. At present I'm pretty sure we are encoding all the untrusted data using the "blessed" cleansers but will check the links just in case we are missing something and then add some comments back in this thread. Thanks
I am Having a same problem. Thanks for that. Just got solution.