Hi @GBhatnagar521131 (Community Member)​ 

I recommend below In order to address this finding CWE 427 on attack vector System.Diagnostics.Process.Start() :

• Ensure that executable you're trying to execute is from known and/or trusted location. For e.g Hardcoded value. I see that you GetDefaultLogoutUri() returns a hardcoded value, which is considered absolutely safe. But I am not getting a clear picture of authorizationRequest object, and there is possibility of taint from other variables used in this object.
• You can use validation approaches like AllowList validation or use Regular expression based pattern checking on any other such variables.
• Maintain AllowList of trusted directories where executables can be located. Refer this URL : https://community.veracode.com/s/article/allowlist-helps-fix-cwe
• If you are using any file references; use methods to resolve the full path such as Path.GetFullPath() to get the fully qualified path and ensuring the directory traversal characters aren't present.

After reviewing and confirming the above guidelines, you can consider raising Mitigation by design proposal for this findings. 

If you still have questions I would recommend you schedule a consultation call to discuss.

You can check out this knowledge article (https://community.veracode.com/s/article/How-to-schedule-a-consultation-call) on how to schedule a consultation call with us.

Regards,

Kashif.

Hello @Kashif, Security Consultant (Veracode inc)​ 

Thank-you for your reply.

I am opening the URL in browser using C# code. Below is the modified version of the previous code snippet I shared. I have now hard-coded the entire URL string and used AllowList approach. It still reports Uncontrolled Search Path Element (CWE ID 427)(1 flaw)

 string authorizationRequest = "https://login.microsoftonline.com/common/oauth2/v2.0/logout?post_logout_redirect_uri=http://localhost/authorize";

List<string> Allowlist = (List<string>)(new String[] { "https://login.microsoftonline.com/common/oauth2/v2.0/logout? post_logout_redirect_uri=http://localhost/authorize" }).ToList(); ;

         if (Allowlist.Contains(authorizationRequest))

         {

            System.Diagnostics.Process.Start(authorizationRequest);

         }

Please suggest.

Thanks,

Gagan