Andre (Community Member) asked a question.
Delaling with flaw CWE 404: Improper Resource Shutdown or Release
We have several CWE-404 issues being reported. After ensuring that all are properly enclosed in using-statements the flaw is still being reported.
In the post from December 16th 2020 the reply from Veracode was that async flaws should be dealt with by 'Mitigation by Design' and non-async flaws should be dealt with by 'False Positive'.
Is this still the recomended way to dealt with the CWE-404?
.png){kind=logo}
Hello @Andre (Community Member),
Thank you for your question around this. The guidance still stands. it sounds like you may be looking to go down the "Mitigate by Design" approach based off what you mentioned. Be sure to review the "Attack Vector" on the Triage Flaws page to double-check the correct class is being disposed with the using statement.
Thanks,
Anthony Fielding