Hello,

I ran Veracode scan on my Windows applications and its dlls.

One of the vulnerabilities reported was:

Directory Traversal(1 flaw)

Associated Flaws by CWE ID: External Control of File Name or Path (CWE ID 73)(1 flaw)

It was on the following line in BOLD text.

How do I rectify it.

string GoogleSecID = System.Environment.GetEnvironmentVariable("GOOGLE_APPLICATION_CREDENTIAL_PATH", EnvironmentVariableTarget.Machine);

string appconfigValue = System.Environment.GetEnvironmentVariable("GOOGLE_APPLICATION_SECRET", EnvironmentVariableTarget.Machine);

GoogleSecID = GoogleSecID.Replace(".p12", "");

string extension = "p12";

string filepath = ValidateFileNamePath(AppDomain.CurrentDomain.BaseDirectory, GoogleSecID, extension);

certificate = new X509Certificate2(filepath, appconfigValue, X509KeyStorageFlags.Exportable);

...

...

...

...

[FilePathCleanser]

private string ValidateFileNamePath(string basePath, string path, string extension)

{

      string[] allowedExtensions = new String[] { "p12" };

      //string extension = ".p12"; // Default extension

      foreach(string allowedExtension in allowedExtensions)

      {

        if (allowedExtension.Contains(Path.GetExtension(path)))

        {

          extension = allowedExtension;

        }

      }

      path = basePath + path + "." + extension;

      string absolutePath = Path.GetFullPath(path);

      if (!absolutePath.StartsWith(basePath))

      {

        throw new Exception("Potential path traversal. Path: " + path + ", AnsolutePath: " + absolutePath);

      }

      return absolutePath;

}

Thanks,

Gagan