RGupta149800 (Community Member) asked a question.
Directory Traversal Flaw is not getting fix with @FilePathCleanser annotation. Should I need to enable some annotation thing in my project's admin settings.
Hi Team... I am getting Directory Traversal Flaw in passing some Filepath to File API. I have used @FilePathCleanser annotation and some esapi input validations to fix this flaw... But The flaw is not getting fix with this. Should I need to enable this annotation in my project's admin section.
Please help me with this a.s.a.p
.png){kind=logo}
Hi,
The @FilePathCleanser annotation can only automate proposing of mitigation proposals (optionally they can also approve, though this is rarely done in practice). It must be enabled in by an administrator in the Custom Cleanser Administration section: https://docs.veracode.com/r/c_cleanser_admin .
I'd strongly urge you to read this article on CWE 73: https://community.veracode.com/s/article/how-do-i-fix-cwe-73-external-control-of-file-name-or-path-in-java .
Note that this flaw typically requires manual review through your companies mitigation process for more information please see: https://docs.veracode.com/r/improve_mitigation
Thank you,
Boy Baukema