GBhatnagar521131 (Community Member) asked a question.
Improper Resource Shutdown or Release (CWE ID 404) flaws have been reported in methods on lines highlighted in BOLD.
Please suggest how to fix these issues?
public static async Task<T> TryReadAsJsonAsync<T>(this HttpContent content)
where T : class
{
Stream stream = null;
StreamReader sreader = null;
try
{
serializer = new JsonSerializer();
stream = await content.ReadAsStreamAsync().ConfigureAwait(false);
sreader = new StreamReader(stream);
....
sreader.Close();
sreader.Dispose();
sreader = null;
stream.Close();
stream.Dispose();
stream = null;
}
catch
{
return null;
}
finally
{
....
...
if (sreader != null)
{
sreader.Close();
sreader.Dispose();
sreader = null;
}
}
return obj;
}
public static async Task<HttpRequestMessage> Clone(this HttpRequestMessage request)
{
.....
.....
using (MemoryStream memoryStream = new MemoryStream())
{
await request.Content.CopyToAsync(memoryStream).ConfigureAwait(false);
memoryStream.Position = 0;
newRequest.Content = new StreamContent(memoryStream);
....
...
}
}
public async static void SaveAppConfig()
{
try
{
.....
using (MemoryStream stream = new MemoryStream())
{
using (StreamWriter writer = new StreamWriter(stream))
{
writer.Write(serializedConfig);
writer.Flush();
stream.Position = 0;
await SaveAsBLOB(AppConfig.UniqueAppID, stream);
}
}
}
catch(Exception ex)
{
if (Global.IsRedirectErrorLogToDB == true)
{
string errorlog = Global.ErrorLog;
Global.RedirectErrorLogToDB(errorlog, "\r\n" + ex.Message + "\r\n" + ex.StackTrace);
}
}
}
public async Task<string> performCodeExchange(string code, string code_verifier, string redirectURI)
{
...
...
Stream stream = tokenRequest.GetRequestStream();
await stream.WriteAsync(_byteVersion, 0, _byteVersion.Length);
stream.Close();
StreamReader reader2 = null;
try
{
using (WebResponse tokenResponse = await tokenRequest.GetResponseAsync())
{
using (Stream stream2 = tokenResponse.GetResponseStream())
{
reader2 = new StreamReader(stream2);
....
...
reader2.Close();
reader2.Dispose();
reader2 = null;
}
}
}
catch (WebException ex)
{
....
....
}
finally
{
if (reader2 != null)
{
reader2.Close();
reader2.Dispose();
reader2 = null;
}
}
return access_token;
}
Thanks,
Gagan
.png){kind=logo}
Hi @GBhatnagar521131 (Community Member) ,
We generally recommend using the `using` statement ( https://learn.microsoft.com/en-us/dotnet/csharp/language-reference/statements/using ) for this flaw category, which is a great construct to use.
Unfortunately, as in this case, Veracode Static Analysis is not always able to detect this construct from the binary, especially when `async` is used.
In these cases we generally recommend you mitigate this as Potential False Positive. You can read more on how to do this here: https://docs.veracode.com/r/improve_mitigation . Note that this will need to be reviewed by someone from your organization with the "Mitigation Approver" right.
Please also note that we have recently downgraded the standard severity of this flaw category to Informational (though your organization may have their own severity for this flaw category) as such you may not be required to fix flaws of this category. If you are unsure please consider contacting your security team.
Please consider registering your ideas on this with Veracode Community Ideas at https://community.veracode.com/s/ideas .
Thank you,
Boy Baukema