mmertpolat (Community Member) asked a question.
C# HttpClient Insertion of Sensitive Information Into Sent Data CWE ID 201
Hello, I have CWE ID 201 Insertion of Sensitive Information Into Sent Data error in my C# project.
The relevant line is as follows:
var httpContent = new StringContent(jsonContent, Encoding.UTF8, "application/json");
HttpResponseMessage response = client.PostAsync(newUrl, httpContent).Result;
My newUrl variable is remote api URL and my httpContent is StringContent variable. I am sending the data entered by the user to the API in the httpContent. What can i do to fix this error?
Thanks.
Mert
.png){kind=logo}
Hi @mmertpolat (Community Member)
I can see that 2 of these arguments passed to PostAsync() function i.e. 'newUrl' & 'httpContent' can potentially contain sensitive data. First being the URL, there is a chance that it might be initialized using some application properties or web configs.
The other variable 'httpContent' need to review what variables and data are used in construction of http response body. You will have to ensure the usage of any such data, confirming any sensitive data that is being transferred is intended and does not violate any application security policy of your organization.
After reviewing and confirming the above, you can consider raising Mitigation by design proposal for this findings.
If you still have questions I would recommend you schedule a consultation call to discuss.
You can check out this knowledge article (https://community.veracode.com/s/article/How-to-schedule-a-consultation-call) on how to schedule a consultation call with us.
Regards,
Kashif.