Hi Team,

​

We are working on fixing the potential threats detected by Veracode. I have gone through many post of how we need to address the flaw. I have taken guidance from the few links and implemented solution to mitigate the flaw. Somehow Veracode still shows it's potential threat.

Anyone can guide me here where I am going wrong. Many Thanks.

Code Snippet as below - >

Public Sub ProcessData(ByVal input As Info, ByVal timestamp As DateTime)

    Try

      ' Check the currently logged in user has the permission to perform this action

       If IsUserAllowedTo(UserPrivileges.ViewMobile, Application.ProductName, True) Then

        Dim mvcPath = Local.MVCPath

        Dim mvcArchievePlaybackArgs = Local.MVCArchivePlaybackArgs

        Dim cameraId As String = input.DeviceID

        Dim filePath As String = Path.GetFullPath(mvcPath)

        Dim pattern As String = String.Format("[a-zA-Z0-9\x20]+$")

        If String.IsNullOrWhiteSpace(mvcPath) OrElse String.IsNullOrWhiteSpace(mvcArchievePlaybackArgs) Then

          Exit Sub

        End If

        'Validate file path

        If Not Regex.IsMatch(mvcPath, pattern) Then

          Exit Sub

        End If

        'Validate file path

        If Not Regex.IsMatch(mvcArchievePlaybackArgs, pattern) Then

          Exit Sub

        End If

        'Validate camera id

        Dim onlyNumbers As String = String.Format("^[0-9]*$")

        If Not Regex.IsMatch(cameraId, onlyNumbers) Then

          Exit Sub

        End If

        Dim cameraArguments As String = String.Format(mvcArchievePlaybackArgs, System.Web.HttpUtility.UrlPathEncode(cameraId), timestamp.ToString(DateTimeFormats.ReverseDate))

        'Validate Arguments

        If Not Regex.IsMatch(cameraArguments, pattern) Then

          Exit Sub

        End If

        If File.Exists(filePath) Then

          Dim fileExtension As String = Path.GetExtension(filePath)

          Dim supportedExtensions As List(Of String) = New List(Of String) From {".exe"}

          If Not String.IsNullOrEmpty(fileExtension) AndAlso supportedExtensions.Any(Function(x) Equals(x, fileExtension)) Then

            Dim process As New Process()

            process.StartInfo.WorkingDirectory = Path.GetDirectoryName(mvcPath)

            process.StartInfo.FileName = mvcPath

            process.Start()

          End If

        End If

      End If

    Catch ex As Exception

      LogException()

    Finally

    End Try

  End Sub