UPatel007528 (Community Member) asked a question.
public static async Task<string> GetToken(string orgCode, string orgID, string apiURL)
{
string strAccessToken = string.Empty;
WebRequest webreq = null;
try
{
if (!string.IsNullOrEmpty(orgCode) && !string.IsNullOrEmpty(orgID))
{
// Enforce TLS 1.2 only; do not weaken with TLS/SSL3.
ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12;
var tokenUri = BuildSafeUri(apiURL, $"Authentication/GetToken?orgCode={WebUtility.UrlEncode(orgCode)}&orgId={WebUtility.UrlEncode(orgID)}");
webreq = WebRequest.Create(tokenUri);
webreq.Method = "GET";
webreq.ContentType = "application/json; charset=utf-8";
using (var res = await webreq.GetResponseAsync().ConfigureAwait(false))
using (var stream = res.GetResponseStream())
using (var streamReader = new StreamReader(stream))
{
strAccessToken = await streamReader.ReadToEndAsync().ConfigureAwait(false);
}
}
else
{
cEventLog.AppendError(cMessages.enmMessageType.mToken, "OrgCode or OrgID null while get token", "", GetCurrentMethod().Name);
return string.Empty;
}
}
catch (WebException webEx)
{
cEventLog.AppendError(cMessages.enmMessageType.mToken, "Token request WebException: " + webEx.Message, orgCode, GetCurrentMethod().Name);
return string.Empty;
}
catch (Exception ex)
{
cEventLog.AppendError(cMessages.enmMessageType.mToken, ex, orgCode, GetCurrentMethod().Name);
return string.Empty;
}
finally
{
// CWE-404 FIX: Explicitly abort the WebRequest to release resources
if (webreq != null)
{
webreq.Abort();
webreq = null;
}
}
return strAccessToken;
}
.png){kind=logo}
Hello @UPatel007528 (Community Member)
Thanks for your post. For this code and the CWE-404 issue you are receiving against the stream variable that is written via the using statement, I recommend you refer to this earlier Community Q&A explanation https://community.veracode.com/s/question/0D53n00007dL1vACAS/404-improper-resource-shutdown-or-release-despite-using-using. The recommendations and context from this post would also apply to your code here. The Veracode static analysis engine is reporting on the finding still given this code and stream resource is within an asynchronous method, but the use of "using" is the correct way to safely dispose of these resources to ensure there is no concern.
You will have to enter and work with your organization's internal security team to approve a mitigation proposal for this finding to resolve the issue that way. For more information and guidance on how to enter a mitigation proposal and how this can be used to address static scan results, please consult the following Veracode documentation resources:
I hope this helps. Should you still have any questions even after reviewing the previous community answer shared above, then please consider scheduling a consultation call to discuss by following the instructions at https://community.veracode.com/s/article/How-to-schedule-a-consultation-call. There is also a "Schedule Consultation" quick scheduling button right on the Veracode Community Home page you can make use of as well.
Best Regards,
Andrew Bell