HP906306 (Community Member) asked a question.
Fix for: Insertion of Sensitive Information Into Sent Data (Fetch function) . CWE 201
Hi,
We are using the fetch function and passing a url to it. Veracode SAST is flagging this as a low level vulnerability (CWE 201) with 'fetch' function as the attack vector. Please suggest a fix for this?
const response = await fetch(url, {
method: 'POST',
headers: {
'Content-Type': 'application/json',
},
.png){kind=logo}
Hi @HP906306 (Community Member) ,
Unfortunately, it is difficult to provide an suggestion without knowing more about the data that is going into the URL.
Typically, for this flaw category we recommend looking at the Data Path (Platform) / Call Stack (IDE Plugin) to review what potentially sensitive information is going into the URL.
Sometimes, this is just a configuration value that is used appropriately, in which case we would recommend you simply document this in a mitigation proposal. You can learn more on how to do this here: https://docs.veracode.com/r/improve_mitigation and https://community.veracode.com/s/knowledgeitem/mitigations-part-1-what-is-a-mitigation-MCKTIDIWZQ3RBENLRUYP4KSZW3SQ .
Other times, sensitive data is sent over inappropriately and we recommend removing the offending code, rescanning will then cause our automated analysis to close the flaw.
I would recommend you schedule a consultation call to discuss.
You can check out this knowledge article (https://community.veracode.com/s/article/How-to-schedule-a-consultation-call) on how to schedule a consultation call with us.
Thank you,
Boy Baukema