Jegatheepan (Community Member) asked a question.
I am getting the CWE 73 issue in the line of OpenWrite()
Fileinfo f = new Fileinfo(path)
Using(var fi = f.OpenWrite())
{
//
}
I have added the pattern whitelisting as per https://downloads.veracode.com/securityscan/cwe/v5/net/73.html#example
But, still issue preexist.
By clicking “Accept All Cookies”, you agree to the storing of cookies on your device to enhance site navigation, analyze site usage, and assist in our marketing efforts.
.png){kind=logo}
These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the site will not then work. These cookies do not store any personally identifiable information.
These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site. All information these cookies collect is aggregated and therefore anonymous. If you do not allow these cookies we will not know when you have visited our site, and will not be able to monitor its performance.
These cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.
@Steven D., Veracode Support (Veracode) @Jason M., Veracode Support (Veracode)
could you able to help on this issue. i can provide if you need more details.
Hi @Jegatheepan (Community Member),
A pattern allow-listing, if strict enough, can be a great security control for CWE 73. Please note that Veracode Static Analysis can, by its nature, not evaluate dynamic forms of validation such as regexes at this point. This means that you would have to propose a mitigation by design and discuss it with your Security Team. For more information on how to propose a mitigation, please refer to https://docs.veracode.com/r/improve_mitigation.
Please feel free to provide the code for the validation you have in place and we can have a look at it and provide you with some feedback.
For more detailed information on CWE 73, this knowledge article might also be handy: https://community.veracode.com/s/article/how-do-i-fix-cwe-73-external-control-of-file-name-or-path-in-java.
Thank you,
Florian Walter
Hi @Florian, Security Consultant (Veracode) ,
Thank you for coming back. as per our report below highlighted C# code line (OpenWrite()) is getting the error.
var regex = new System.Text.RegularExpressions.Regex(@"\.\.|\\|/ ")
if (!regex.IsMatch(filename)
{
// open write method
}
We have tried couple of other ways as well.
Please suggest a best way to avoid this issue
Thanks
Hi @Jegatheepan (Community Member),
The above regular expression leverages a blocklist and is not something we would ever recommend. All throughout security history, insufficient blocklists have been bypassed using a case that the creator of the blocklist didn't consider.
Instead, we would recommend using an allow-list and explicitly specifying all allowed characters. As an example for `filename`, one could split it into the actual file name and the file extension. One could then validate the file extension against a strict allow-list of allowed extensions, and validate that the actual file name is alphanumeric. An example regex that checks if a given string is alphanumeric would be `^[a-zA-Z0-9]{1,255}$` (without the ticks). That regex would check that a provided string has between 1 and 255 alphanumeric characters (please feel free to adjust this to your use case). That would be a great set of mitigating controls against CWE 73.
Please note that dynamic forms of validation, such as a regex, cannot be evaluated by static analysis at this point and you would have to propose a mitigation and discuss it with your organization's Security Team. For more information on how to do this, please refer to https://docs.veracode.com/r/improve_mitigation.
Thank you,
Florian Walter