ABS110931 (Community Member) asked a question.
CWE ID 1174: Improper Model Validation reported even Data Annotations exist
HI Team,
As per Veracode recommendation, I have added data annotations against all my string properties in the Model but still it is reporting this improper model validation flaw.
Additionally , I am using custom validation attribute for numeric and guid types.
Sample code:
public class sample{
[DataType(DataType.Text)]
public string Name { get; set; }
[DataType(DataType.MultilineText)]
public string XML { get; set; }
[ValidGuid]
public string guid { get; set; }
[IsNumeric]
public string UserId { get; set; }
}
Please suggest.
.png){kind=logo}
Hello @ABS110931,
Veracode Static Analysis will report CWE 1174 in .NET applications due to lack of Data Annotations, which can be remediated as shown in your sample code, as well as due to the model validation not being checked in a controller action or missing route attribute validation. More details about each of these three scenarios can be found in this Community article: (https://community.veracode.com/s/article/NET-Remediation-Guidance-for-CWE-1174).
If you have not done so already, I would recommend expanding the flaw details on the Triage Flaws page for your most recent scan to verify which scenario is the reason each of your CWE 1174 flaws are being reported. You can do so with the triangle icon in the ID column on the Triage Flaws page.
If you are confident that you have addressed the issue, you can document this in a mitigation proposal (https://docs.veracode.com/r/improve_mitigation) and request a review from your security team. If you would like more detailed remediation guidance I would recommend scheduling a consultation call to discuss. You can check out this knowledge article (https://community.veracode.com/s/article/How-to-schedule-a-consultation-call) on how to schedule a consultation call with us.
Best regards,
Michael Roberson