Hi @KirankumarBharsadiya (Community Member)​ ,

Veracode Static Analysis should not report constructors for CWE 915, though sometimes missing debugging symbols or the use of async constructs (for which the compiler generates a lot of constructs) may make it difficult for us to give you the correct line number from the binary at is may appear to report the first line, corresponding to the constructor.

Please look at the detailed description for this flaw in the Veracode Platform and verify that the 'Attack Vector' as well as the 'Data Path' both point to the constructor.

If this points to the constructor, please create a case with Veracode Support through the link in the footer of the Veracode Platform ('Contact Support') or through the Veracode Community in the menu on the top right after clicking on your avatar ('Contact Support') and provide the flaw id as well as a link to the Triage Flaws view in the Veracode Platform where the flaw can be found.

Otherwise this should provide you with details for this flaw.

Veracode Static Analysis only automatically detects use of [Bind(Include="Property1,Property2")] (see also: https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.mvc.bindattribute.include?view=aspnetcore-7.0 ) as remediation (automatically closes the flaw upon rescan).

You may also chose to use a "ViewModel" or "Data Transfer Object (DTO)" pattern where all properties are designed to be bound to but we will not automatically recognize this and you must then manually document this in a mitigation proposal. You can learn more about this here: https://docs.veracode.com/r/improve_mitigation . This must then be reviewed by someone in your organization with the 'Mitigation Approver' right.

Please let me know if you have any remaining questions or concerns.

Thank you,

Boy Baukema