SBatra331409 (Community Member) asked a question.
"CWE 73 - External Control of File Name or Path" is not resolved even after implementing all the suggested fixes.
The following line in my codebase
fs = new FileStream(filename, FileMode.Open, FileAccess.Read);
is causing "CWE 73 - External Control of File Name or Path" security vulnerability.
I have applied all the 3 solutions mentioned at the following url (code snippets are in java but equivalent implementation is done in C# at my end)
In addition to that I have also used [FilePathCleanser] attribute as well (on a helper function to validate incoming path value) but the outcome is still same.
Any help would be much appreciated.
Thank you,
Suraj Kumar Batra
.png){kind=logo}
Hello @SBatra331409 (Community Member),
When a path is constructed from data Veracode considers untrusted, irrespective of any controls the flaw will be raised. Veracode will not stop reporting the flaw because of a regular expression check being added for example. I recommend you propose a "Mitigation By Design" and document these three controls in place and how they reduce or remove the risk. You can learn more about the mitigation process here: https://docs.veracode.com/r/Propose_Mitigating_Factors_for_a_Flaw.
I hope that answers your question.?
Thanks,
Anthony Fielding