MKHAN174237 (Community Member) asked a question.
I read a few articles and was mentioning to use isValidInput to fix this flaw but looks like after running the scan it's still picking up as a flaw. Below is the code I added. Please, someone can guide me on this would be great. Thanks!
String redirectURL = request.getRequestURL().toString().toLowerCase();
redirectURL = redirectURL.replace("/application/home#/home", "/application");
boolean isValidURL = ESAPI.validator().isValidInput("Home_redirect", redirectURL, "PortalUserRedirect", 100, false);
if(isValidURL)
return new ModelAndView("redirect:" + ESAPI.encoder().canonicalize(redirectURL));
else
throw new Exception("Looks like you are accessing wrong URL. Please, verify the url.");
.png){kind=logo}
Hi,
Kindly refer to this link for the supported cleansing functions:-
https://docs.veracode.com/r/Supported_Java_Cleansing_Functions
(Please refer to the right column to ensure that it addresses CWE 80)
If one of these functions is used, the Veracode SAST scanner will recognize it and won't flag the CWE 80 finding.
ESAPI Validator() is not recognized, as it depends on what is defined in ESAPI.properties / validation.properties file, and the validation pattern is used for 'PortalUserRedirect' in this case.
ESAPI.encoder().canonicalize() is also not listed as a supported cleansing function.
If you still have questions I would recommend you schedule a consultation call to discuss.
You can check out this knowledge article (https://community.veracode.com/s/article/How-to-schedule-a-consultation-call) on how to schedule a consultation call with us.
Regards,
Kashif