GSengodan192690 (Community Member) asked a question.
System.IO.TextWrite.WriteLine() - Usage error (CWE Code : 209 Generation of error message containing sensitive information)
Hello Community,
We have a .NET application in which The application is not using System.IO.TextWrite.WriteLine() anywhere But while doing Veracode static scan the report says "The application calls the mscorlib_dll.System.IO.TextWrite.WriteLine() function, Which may expose information about the application logic or Other details such as names and versions of the application container and associated components. "
This is the assembly name Antlr3.runtime.dll where Veracode reported the flaw.
Below is the Flaw details:
CWE Code : 209 Generation of error message containing sensitive information
Please advise on the above issue.
Thank you,
Gunasekaran
.png){kind=logo}
Hi Gunasekaran,
It seems like you might be selecting Antlr3.runtime.dll as an entry point when it really shouldn't be. More information on entry point or module selection can be found on this community document: https://community.veracode.com/s/article/What-are-Modules-and-how-do-my-results-change-based-on-what-I-select.
This could also be a sign of an inappropriate compilation/upload step as well, make sure to read our .NET application packaging instructions in full as well; these can be found here: https://docs.veracode.com/r/compilation_net.
If you have any difficulties or questions not answered by these documents, I would recommend you schedule a consultation call and one of us consultants would be happy to walk you through it.
Cheers,
Tyler Krause Ferris
Veracode Application Security Consultant