TNguyen733282 (Community Member) asked a question.
This project is an .Net 8 web application
I got an ASP.NET Misconfiguration: Improper Model Validation (CWE ID 1174). The report highlights the constructor method line. I just followed the recommended fix in .NET Remediation Guidance for CWE-1174, but it's not a clear flaw.
Here is the following code:
[HttpPost]
[Route("/submit/otherformbooking/saveinfo")]
public async Task<IActionResult> SaveOtherFormInfoAsync([FromForm] [Bind(Include = "ReservationFirstName, ReservationLastName, EmailAddress, SpecialRequest")] OtherBookingRequest formRequest)
{
if( ! ModelState.IsValid)
{
return BadRequest();
}
// Business logic
await _sharedMethods.SaveInfo(formRequest);
}
public class OtherBookingRequest
{
[Required]
[StringLength(1000)]
public string ReservationFirstName { get; set; }
[Required]
[StringLength(1000)]
public string ReservationLastName { get; set; }
[Required]
[StringLength(1000)]
public string EmailAddress { get; set; }
[StringLength(1000)]
public string? SpecialRequest { get; set; } = string.Empty;
}
I just tried to remove the async/await from this method and it's clear the flaws. However asynchronous is required in this project. So we can't afford to remove it.
Please help to check, and any advice on clearing flaws?
I checked and found a related issue a long time ago: https://community.veracode.com/s/question/0D53n00007Y92VMCAZ/any-advice-on-clearing-flaw-aspnet-misconfiguration-improper-model-validation
.png){kind=logo}
Hello @TNguyen733282 (Community Member),
Thanks for asking about this. It is interesting that the issue goes away when you remove async/await. Clearly you need the code to be asynchronous so please revert that change and re-scan if you haven't already. The fix for this CWE (as per our guide here: https://community.veracode.com/s/article/NET-Remediation-Guidance-for-CWE-1174) is to add the data annotations, which it appears you have. Please can you get me the Veracode Platform URLs to the two SAST scans where you removed async (no CWE-1174 flaw reported) and the one where we report CWE-1174 with the data annotations and async code in place, so I can see about getting a ticket raised. You can DM me the scan URLs or reply to this message with them.
Thanks,
Anthony Fielding