MNGL (Community Member) asked a question.
Code has CWE 78:
private void textBox_PreviewMouseDoubleClick(object sender, System.Windows.Input.MouseButtonEventArgs e)
{
SysprepLogViewInfo log = lstView.SelectedItem as SysprepLogViewInfo;
if (log != null)
{
string Logfile = System.IO.Path.Combine(log.Location, log.DisplayName);
if (System.IO.File.Exists(Logfile))
Process.Start("notepad.exe", Logfile);
}
}
//////////////////////////////////////////////////////////////////////////
My fix that does not work:
private void textBox_PreviewMouseDoubleClick(object sender, System.Windows.Input.MouseButtonEventArgs e)
{
SysprepLogViewInfo log = lstView.SelectedItem as SysprepLogViewInfo;
if (log != null)
{
string Logfile = System.IO.Path.Combine(log.Location, log.DisplayName);
var valDesc = new Regex(@"[a-zA-Z0-9\x20]+$");
if (!valDesc.IsMatch(Logfile))
{
System.Windows.MessageBox.Show(string.Format("log file selected is invalid."), "Error");
}
else
{
if (System.IO.File.Exists(Logfile))
Process.Start(Logfile);
{
}
}
.png){kind=logo}
Here is another fix and it did not fix CWE 78 either:
private void textBox_PreviewMouseDoubleClick(object sender, System.Windows.Input.MouseButtonEventArgs e)
{
SysprepLogViewInfo log = lstView.SelectedItem as SysprepLogViewInfo;
if (log != null)
{
string Logfile = System.IO.Path.Combine(log.Location, log.DisplayName);
List<string> logList = new List<string>
{ "C:\\Windows\\Panther\\setupact.log",
"C:\\Windows\\Panther\\setuperr.log",
"C:\\Windows\\Panther\\UnattendGC\\setupact.log",
"C:\\Windows\\Panther\\UnattendGC\\setuperr.log",
"C:\\Windows\\System32\\sysprep\\Panther\\setupact.log",
"C:\\Windows\\System32\\sysprep\\Panther\\setuperr.log"};
if (!logList.Contains(Logfile))
{
System.Windows.MessageBox.Show(string.Format("The log file selected is invalid."), "Error");
}
else
{
if (System.IO.File.Exists(Logfile))
Process.Start(Logfile);
}
}
}
Hi @MNGL (Community Member) ,
Veracode Static Analysis will report CWE 78 Improper Neutralization of Special Elements used in an OS Command (OS Command Injection) if it can detect that there are strings from outside of the application (HTTP Request, File, Database, webservice, etc.) being used in a command or it's arguments.
We recommend hardcoding allowed inputs and using only hardcoded data in OS commands executed by the application.
If this is not possible and you must allow some dynamic inputs, then we recommend adding strict allowlist validation.
For more information on what Veracode Static Analysis can detect please see: https://community.veracode.com/s/article/Using-an-Allow-list-in-a-Way-Static-Analysis-can-Detect
If you are unable to use a hardcoded arguments you can also consider using a regex and proposing a mitigation ( https://docs.veracode.com/r/Propose_Mitigating_Factors_for_a_Flaw ) on this flaw from the Veracode Platform or IDE plugin. In this proposal please describe the controls you have in place to prevent an attacker from abusing this functionality. Then contact your security team to have these proposals reviewed.
Fixing this flaw can be deceptively hard. Please consider Scheduling a Consultation ( https://docs.veracode.com/r/t_schedule_consultation ) to meet with one of our Veracode Application Security Consultants to discuss this flaw and any other flaws you'd like to remediate.
Thank you,
Boy Baukema