Hello @PShrestha542340,

Veracode static analyzer reports a CWE-501 flaw whenever it detects that external tainted user supplied data is getting used within an application session. Letting external data construct your session could lead to potential attack scenarios where attackers can provide values that allow them to hijack intended session creation and validation from what your application intends.

I don't have full context into the particular flaw that Veracode reported, but from what I can see based on the single line of code you mentioned, you do appear to be setting session attributes using parameter inputs that do suggest coming from external sources. Namely, the `rpt_param_name` value whose name suggests that we could be reading and accepting data that comes from external request parameters. For instance, as part of an HTTP request that end users issue to your application. If we do not have secure checks in place here, it can lead to potential attack scenarios like I've described above.

Sadly, there is no supported cleanser that you can apply to this line of code that Veracode static analyzer will recognize and use to auto-remediate the flaw. The only option that Veracode supports for remediation and auto-resolution of the flaw is to hardcode the values that you are passing to `session.setAttribute()` call. You should not read this information in from an external input source if it can be helped. Keep in mind that user supplied input is not limited to just reading in information from HTTP requests -- external source of input can also include reading from files on your server and database queries, among other potential sources.

If you are unable to hardcode the strings for your use case, then we instead recommend that you apply strict input validation to your application's enforcement of what valid session identifiers need to look like and then document this control using the Veracode custom mitigation workflow. To learn and read more about how the Veracode mitigation process is done and what you need to do, please check the following resources:

https://community.veracode.com/s/knowledgeitem/mitigations-part-1-what-is-a-mitigation-MCKTIDIWZQ3RBENLRUYP4KSZW3SQ

https://docs.veracode.com/r/improve_mitigation

You will need to involve your organization's security team as part of any mitigation proposal you create. Your security team is in charge of reviewing and approving any mitigations.

I hope this covers your issue and gives you a path forward, but do let me know if you should have any remaining questions or concerns.

All the best,

Andrew Bell