DJ (Community Member) asked a question.
Supported cleansing functions C# CWE-117
In the list of supported cleansing functions for CWE-117, https://docs.veracode.com/r/Supported_NET_Cleansing_Functions, there are some which do not really solve the issue (or I'm missing something)
For instance there is System.Security.SecurityElement.Escape (which again the page explicitly mentions this can be used for solving CWE-117), however SecurityElement.Escape doesn't replace newlines in strings, which CWE-117 is all about.
if I run for example:
Console.WriteLine(System.Security.SecurityElement.Escape("Line 1\r\nLine 2"));
the output is:
Line 1
Line 2
including the newline which should've been be escaped. What am I missing?
.png){kind=logo}
Hi @DJ (Community Member) ,
You're not missing anything. We've made changes to Veracode Static Analysis to remove this as an accepted cleansing function and will make change to our documentation to reflect it upon release of this new version, currently expected to be released at the end of January '23.
Please consider subscribing to our Product Updates at https://info.veracode.com/Subscription-Management.html to be notified.
Thank you,
Boy Baukema
It's still listed as supported cleansing function: Supported .NET Cleansing Functions | Veracode Docs
Hi @DJ (Community Member) ,
I am reviewing your request above and will respond with details shortly.
Thank you,
Mike