Hello @RShetty166026 (Community Member)​ ,

The best possible fix for CWE- 601 in the above code snippet, is to validate all the untrusted data that goes into the construction of the URL. i.e. In this scenario, you will have to validate "query" that includes parameter 1 and parameter 2 and also the BASE_API_URL value (if it is fetched from a tainted source like a database for example). Please note that encoding the variables here does not remediate the risk for CWE-601.

For validating the parameters and the base url here, we would recommend using a combination of allow-list and Regex pattern check routines to be performed (as applicable for your usecase). You can create a list of accepted or valid base URLs against which the BASE_API_URL value can be validated against. For the parameters, you can use a Regex pattern to restrict the type of values that are expected.

You can also refer to the best practices on validating URLs in the OWASP cheat sheet - https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html#preventing-unvalidated-redirects-and-forwards

Reference: https://www.veracode.com/security/java/cwe-601

Please note : The input validation routine here would be considered as a custom check and would require a mitigation on the Veracode Platform. For more information on mitigating flaws, please refer to: https://docs.veracode.com/r/improve_mitigation