Jesse C (Community Member) asked a question.
Since support for finding CWE-285 in .NET was added, we have many findings for this issue on our static scans, but I'm confused by the findings.
We have a BaseController class that has the [Authorize] attribute on it, and then many controllers that inherit from BaseController, some of which don't have their own [Authorize] attribute. The ones that don't have the attribute directly do inherit it from the BaseController, but they're still showing up as a CWE-285 flaw on the static scan.
But the weirdest part is that BaseController itself is showing up on the scan with a CWE-285 finding. And it's listed 86 times, all for the same flaw on the same line of code. And the line of code is for the class constructor, not the class itself.
I can of course submit these as potential false positives, but something seems wrong here. Is this a bug in the scan itself, or am I missing something in what needs to be done to resolve these issues?
.png){kind=logo}
Hi @Jesse C (Community Member) - To give more prescriptive advice, I'd suggest sending us a Scan Link via a Support Case here: https://community.veracode.com/s/contact-support
Then you could schedule Consultation Call - we have a link on our community homepage on the right side, if you're logged in. During that call, we can review your scan and give you advice on how to resolve these issues.