JMadaras064603 (Community Member) asked a question.
Help! We have many of CWE-1174 ASP.NET Misconfiguration: Improper Model Validation flaws but we do validate - just not using ASP.NET model validation.
In our coding framework, we use WEB API for Rest, but we have moved all validation to our service layers so that the validation is performed consistently regardless of whether the service method that processes the request is called from an API, another service, or some other program. As a result, we don't rely on ASP.NET model validation and don't decorate our API models as such. As a result, we end up with 100s of these flaws. Is there a graceful way to handle this? E.g. maybe some sort of cleanser attribute on the API model class to tell the scanner that we are handling validation elsewhere? It feels messy to mitigate this many items.
Thanks!
.png){kind=logo}
Hi @JMadaras064603 (Community Member),
I recommend reviewing this article for detailed information on CWE-1174 remediation. If the techniques described aren’t relevant to your use case, you’ll need to rely on the mitigation mechanism to handle these findings. Veracode Static Analysis does not provide custom cleansers for CWE-1174 and will not suppress findings based on any class-level attributes. If you would like to request such a feature, you can let our Product Managers know by submitting an "Idea" here.
Kind regards,
Dee