Hi @PSaxena149153 (Community Member)​ ,

I'm unable to see where CWE 259 would be reported. I would recommend you schedule a consultation call to discuss.

You can check out this knowledge article (https://community.veracode.com/s/article/How-to-schedule-a-consultation-call) on how to schedule a consultation call with us.

Thank you,

Boy Baukema

Hi Team,

Getting CWE 259 on the http client code I have already replace the hardcoded parameter value form the setting but still I'm getting the same.

 public async Task<VimeoResponse> GetPlayListVideos(string playListID, string clientId, string clientSecret)

    {

      var vimeoEndpoints = SettingsKeyInfoProvider.GetValue("VimeoAPIURL");

      var vimeoUriParameter = SettingsKeyInfoProvider.GetValue("ViemoParameter");

      var viemoAddress = $"{vimeoEndpoints}{playListID}{vimeoUriParameter}{this.GetVimeoAccessToken(clientId, clientSecret)}";

      var httpResponse = await this.httpClient.GetAsync(new Uri(viemoAddress));

      var response = await httpResponse.Content.ReadAsStringAsync();

      return JsonConvert.DeserializeObject<VimeoResponse>(response);

    }

Likely this stems from having the word "Secret" in a variable. I've seen Veracode flag the string "CSharpAssembly" because it has the substring "pAss" in there. When you retrieve the actual value of the "clientSecret", where does that come from? If that value comes from any source that is not a fit-for-purpose secret management solution (e.g. azure key vault) then this should be addressed or accepted.

If the value *is* inside a keyvault and the only thing Veracode is flagging is the fact that you should validate that there is not really a hard-coded secret, then this would classify a s a false positive.