What: Veracode will be deprecating support of .NET cleansers from the following functions for flaw classes CWE-93, CWE-113, and CWE-117:

• antixsslibrary.dll : Microsoft.Security.Application.AntiXss.HtmlAttributeEncode
• antixsslibrary.dll : Microsoft.Security.Application.AntiXssEncoder.HtmlAttributeEncode
• antixsslibrary.dll : Microsoft.Security.Application.Encoder.HtmlAttributeEncode
• antixsslibrary.dll : Microsoft.Security.Application.Encoder.HtmlEncode
• mscorlib.dll : System.Security.SecurityElement.Escape
• system.dll : System.Net.WebUtility.HtmlEncode
• system.web.dll : System.Web.HttpServerUtility.HtmlEncode
• system.web.dll : System.Web.Security.AntiXss.AntiXssEncoder.HtmlEncode
• system.web.dll : System.Web.Util.HttpEncoder.HtmlAttributeEncode
• system.web.dll : System.Web.Util.HttpEncoder.HtmlEncode
• system.web.mvc.dll : System.Web.Mvc.HtmlHelper.AttributeEncode
• system.web.mvc.dll : System.Web.Mvc.HtmlHelper.Encode
• system.windows.browser.dll : System.Windows.Browser.HttpUtility.HtmlEncode
• system.windows.dll : System.Net.HttpUtility.HtmlEncode
• System.Runtime.dll : System.Net.WebUtility.HtmlEncode

Why: The decision to deprecate these cleansers is ultimately due to the timing. We’ve reached that point where these cleansers aren’t considered best practice, are insufficient, or inappropriate, for dealing with the CWE at hand. Now feels like a good time to urge our customers to better alternatives, that do a better job of mitigating the CWE, easier to access, integrate with current development practices and offer much better practices going forward.

Some details:

• Some of the cleansers we’re suggesting to deprecate are not available by default, or simply impossible to use in .NET 6+ and .NET Framework 4.6.1 and up.
• For CWE 117, the remaining problem is only if content gets written to a flat logfile. For example, in the cases of an adapter that writes to a centralized logging DB or service, or a Windows System EventLog, then this isn’t much of an issue, and most likely resulting in a truncation of data.

Veracode will now flag usage of theses cleansers for the above functions with CWE-159 (severity 0), here is an example of the informational message that will be included:

The encoding scheme used in this call to System.Web.Util.HttpEncoder.HtmlEncode does not sufficiently handle the carriage-return line-feed (CRLF) sequence. This possibly leaves the application open to log forgery (CWE 117) and HTTP response splitting (CWE 113) if the data is not sanitized for CRLF sequences for the context where the data is going to be used. Writing un-sanitized data into a log can potentially allow an attacker to forge log entries or inject malicious content into log files. Writing un-sanitized data into HTTP header could allow an attacker to manipulate the HTTP response by injecting additional headers or adding an entire response into the response stream. Injecting headers can also be used to trick the security mechanisms in browsers into allowing XSS style attacks.

To fully protect your application against CRLF attacks, it is important to use one of the encoders that will have support for the specific CWE context. Look into the Supported Cleansers for determining the appropriate one for the used CWE context. In addition, as a best practice, always validate user-supplied input to ensure that it conforms to the expected format, using centralized data validation routines when possible.

When: Upcoming Static Engine September release on 09/28/2023

References:

CWE-159: Improper Handling of Invalid Use of Special Elements

OWASP CRLF Injection

About Supported Cleansing Functions