DMihai897467 (Community Member) asked a question.
So I have the following endpoint, to which I have applied sanitization:
@POST
@Path("data")
public List<MyObject> save(final List<MyObject> datas) {
try {
List<MyObject> sanitizedInputList = sanitizeAndConvert(datas);
return sanitizeAndConvert(sanitizedInputList);
} catch (final DataAccessException ex) {
throw CustomException.getRuntimeException(ex);
}
}
private List<MyObject> sanitizeAndConvert(List<MyObject> datas) {
List<MyObject> sanitizeList = new ArrayList<>();
for (MyObject object: datas) {
sanitizeList.add(sanitizeObject(object));
}
return sanitizeList;
}
private MyObject sanitizeObject(MyObject object) {
MyObject sanitizedObject = new MyObject();
sanitizedObject.setStringValue(SafeHtmlUtils.htmlEscape(object.getStringValue));
sanitizedObject.setIntegerValue(object.getIntegerValue);
//and so fort depending on each datatype
return sanitizedObject;
}
But I can't seem to make it work. I also tried using the OWASPI Encoder. I can't seem to make it work.
Can anyone point me in the right direction please? To what am I doing wrong?
Thank you so much
.png){kind=logo}
Hi @DMihai897467 (Community Member) ,
Veracode Static Analysis 'taints' objects that are provided as inputs. To ensure we can see that the entire object has been cleaned you should create a brand new object and copy data, passing it through the HTML encoder, onto the new object. Only then will Veracode Static Analysis see this new object as 'safe'.
Please let me know if you have any remaining questions or concerns.
Thank you,
Boy Baukema
PS: Unfortunately, Community responses emails are currently offline, if you have any questions or concerns I would recommend you schedule a consultation call to discuss.
You can check out this knowledge article (https://community.veracode.com/s/article/How-to-schedule-a-consultation-call) on how to schedule a consultation call with us.