GBhatnagar521131 (Community Member) asked a question.
How do I fix Information Leakage - Insertion of Sensitive Information Into Sent Data (CWE ID 201) ?
Hello,
I performed Veracode scan for my Windows App EXE written in C#.
One of the flaws reported on the line in BOLD was:
Information Leakage - Insertion of Sensitive Information Into Sent Data (CWE ID 201)(2 flaws)
private async Task<HttpResponseMessage> SendOneDriveRequest(HttpRequestMessage request, HttpClient client)
{
request.Headers.Authorization = new AuthenticationHeaderValue("bearer", this.CurrentToken.AccessToken);
var response = await client.SendAsync(request).ConfigureAwait(false);
How do I FIX it ?
Thanks,
Gagan
.png){kind=logo}
Hi @GBhatnagar521131 (Community Member)
The Flaw CWE 201 flagged on attack vector HttpClient.SendAysnc() or HttpClientPostAsync() depends on 2 variables the request it self and the how the HttpClient is instantiated.
After reviewing and confirming the above guidelines, you can consider raising Mitigation by design proposal for this findings.
If you still have questions I would recommend you schedule a consultation call to discuss.
You can check out this knowledge article (https://community.veracode.com/s/article/How-to-schedule-a-consultation-call) on how to schedule a consultation call with us.
Regards,
Kashif.
Hello @Kashif, Security Consultant (Veracode inc)
Thank-you for your suggestions.
Can you please tell me how do I validate and sanitize the data ?
Do you mean the request uri such as:
"?select=id,@microsoft.graph.downloadUrl"
where HttpClient is initialized as:
this.oneDriveHttpClient = new HttpClient()
{
BaseAddress = new Uri("https://graph.microsoft.com")
};
Please see code snippet for your reference.
public async Task<OneDriveRoot> GetTeamMember(string email)
{
List<OneDriveRoot> members = new List<OneDriveRoot>();
OneDriveResponse<Root> response = await this.ListTeamMembers<Root>("/v1.0/users").ConfigureAwait(false);
.....
.....
.....
}
private async Task<OneDriveResponse<T>> ListTeamMembers<T>(string requestUri)
{
// Send the request to OneDrive and get the response.
var response = await this.SendOneDriveRequest(new HttpRequestMessage(HttpMethod.Get, requestUri)).ConfigureAwait(false);
.....
.....
}
public async Task<Uri> GetDownloadUriForItem(string id, string userid)
{
HttpRequestMessage request = new HttpRequestMessage(HttpMethod.Get, "/v1.0/users/" + userid + "/drive/items/" + id + "? select=id,@microsoft.graph.downloadUrl");
var response = await this.SendOneDriveRequest(request).ConfigureAwait(false);
.......
.......
}
private async Task<HttpResponseMessage> SendOneDriveRequest(HttpRequestMessage request)
{
this.oneDriveHttpClient = new HttpClient()
{
BaseAddress = new Uri("https://graph.microsoft.com")
};
request.Headers.Authorization = new AuthenticationHeaderValue("bearer", this.CurrentToken.AccessToken);
var response = await this.oneDriveHttpClient.SendAsync(request).ConfigureAwait(false);
// Check for token refresh
if (response.StatusCode == HttpStatusCode.Unauthorized)
{
var authresult = new AuthenticationResult();
authresult.Code = this.CurrentToken.RefreshToken;
this.CurrentToken = await GetAccessToken3(authresult);
var newRequest = await request.Clone().ConfigureAwait(false);
newRequest.Headers.Authorization = new AuthenticationHeaderValue("bearer", this.CurrentToken.AccessToken);
LogRequest(newRequest, this.oneDriveHttpClient.BaseAddress);
// Dispose of the previous response before creating the new one
response.Dispose();
response = await this.oneDriveHttpClient.SendAsync(newRequest).ConfigureAwait(false);
LogResponse(response);
}
return response;
}
Thanks,
Gagan