AChoudhary189447 (Community Member) asked a question.
Veracode Scan is throwing large number of flaws mentioning them to be CWE ID 73. The flaws are being mentioned for the following type of code:
let tmpPath = path.resolve(os.tmpdir(), uuid.v4())
if (!fs.existsSync(tmpPath)) { fs.mkdirSync(tmpPath); } //mentioned as a flaw by Veracode scan
Recommendation provided by Veracode are on the lines of: Assume all user-supplied input is malicious. Validate all user-supplied input to ensure that it conforms to the expected format, using centralized data validation routines when possible.
However, I don't see the first line of code above posing any security vulnerability since it is using uuid to construct file path which is being used as the input by the second line of code above. Using uuid to create a secure file name has also been recommended here: https://community.veracode.com/s/article/how-do-i-fix-cwe-73-external-control-of-file-name-or-path-in-java
Am I getting false positive above or am I missing something?
.png){kind=logo}
Hi @AChoudhary189447 (Community Member) ,
I will need a bit more context for to reply. I would recommend you contact our technical support team. Here's how you can log a case:
1. Navigate to the upper right corner of any page in the Community, click on your user avatar.
2. Select Contact Support from the drop-down menu.
Please ensure that you include in your case:
Thank you,
Boy Baukema