CHung154202 (Community Member) asked a question.
How to fix : Fill() constructs a dynamic SQL query using a variable derived from untrusted input.
Hi, here are my snippet code, simplified for explanation
this.Command = new SqlCommand(<storedProcedureName>, this.Connection);
this.Command.CommandType = CommandType.StoredProcedure;
SqlParameter parameter = new SqlParameter(name, <value>);
parameter.Direction = direction;
this.Command.Parameters.Add(parameter);
this.Command.Prepare();
da = new SqlDataAdapter(this.Command);
ds = new DataSet();
da.Fill(ds);
Then I got this :
Fill() was called on the da object, which contains tainted data.
How to solve this ?
I don't get the main point of veracode saying tainted data
.png){kind=logo}
Hi @CHung154202 (Community Member)
It appears to me that this.Command uses a variable for <storedProcedureName>, which is believed to be tainted data.
Please review how this variable is initialized.
If you can define an allowlist(whitelist) containing all stored procedure names in it, then, the variable can be validated against it so that scanner can trust the variable.
Please see the allowlist approach article here:
https://community.veracode.com/s/article/allowlist-helps-fix-cwe
Also, refer the article regarding various ways to mitigate the CWE 89 SQL Injection flaws :
https://community.veracode.com/s/article/How-to-fix-CWE-89-SQL-Injection-flaws
https://community.veracode.com/s/article/sql-injection-mitigation-page2
If you still have questions I would recommend you schedule a consultation call to discuss.
You can check out this knowledge article (https://community.veracode.com/s/article/How-to-schedule-a-consultation-call) on how to schedule a consultation call with us.
Regards,
Kashif