ATodd152844 (Community Member) asked a question.
Veracode Static Scanner does not recognise a valid solution to CWE-915 where the BindAttribute is specified on the ViewModel class.
Given the following view model with a BindAttribute specifying properties to Include which is a supported means of preventing over-posting.
The static veracode scanner still flags up flaws CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes
.png){kind=logo}
Hi @ATodd152844 (Community Member)
It is best to get more details on how the taint is originating from the 'Description' of the specific flaw from the Triage Flaws page.
If after reviewing the details in the Triage Flaws view in the Veracode Platform you still have questions I would recommend you schedule a consultation call to discuss.
You can check out this knowledge article (https://community.veracode.com/s/article/How-to-schedule-a-consultation-call) on how to schedule a consultation call with us.
Regards,
Kashif
Its incredibly frustrating how many of these answers are just to create a consult
Hi @ATodd152844 (Community Member),
I submitted an enhancement request to our engineering team based on your question. All being well, this enhancement will be released at the end of October. If you still see the CWE-915 flaw after that, please send an email to support@veracode.com with the details, including a scan link and a flaw ID.
Kind regards,
Duncan