UPatel007528 (Community Member) asked a question.
[FilePathCleanser]
public static async Task<T> SendAsyncRequest<T>(string apiURL, string apiMethodName, string orgCode, string orgID, HttpMethod httpMethod, string requestParams)
{
try
{
// Enforce TLS 1.2 only.
ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12;
// Use HttpClientHandler with default certificate validation.
var handler = new HttpClientHandler();
using (var client = new HttpClient(handler))
{
string token = await GetToken(orgCode, orgID, apiURL).ConfigureAwait(false);
client.DefaultRequestHeaders.Accept.Clear();
client.DefaultRequestHeaders.Add("OrgCode", orgCode);
client.DefaultRequestHeaders.Add("OrgID", orgID);
client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", token);
client.Timeout = TimeSpan.FromMinutes(60);
// Build and validate destination safely
var requestUri = BuildSafeUri(apiURL, apiMethodName);
using (var request = new HttpRequestMessage
{
Method = httpMethod,
RequestUri = requestUri,
// CWE-201 FIX: Send ORIGINAL data to API (not sanitized!)
Content = new StringContent(requestParams ?? string.Empty, Encoding.UTF8, "application/json")
})
{
// Send request
using (var apiResponse = await client.SendAsync(request).ConfigureAwait(false))
{
var responseContent = await apiResponse.Content.ReadAsStringAsync().ConfigureAwait(false);
if (apiResponse.IsSuccessStatusCode)
{
var data = JsonConvert.DeserializeObject<T>(responseContent);
if (data == null)
{
// CWE-201 FIX: Sanitize ONLY for logging (not for API!)
string sanitizedRequest = SanitizeForLogging(requestParams);
string sanitizedUri = SanitizeUriForLogging(request.RequestUri);
string error = $"Error in Api:{sanitizedUri}, ResponseContent not deserialized, HttpStatus:{apiResponse.StatusCode}. Error:{responseContent}, RequestContent:{sanitizedRequest}";
cEventLog.AppendError(cMessages.enmMessageType.mApiRequest, error, orgCode, GetCurrentMethod().Name);
}
return data;
}
else
{
// CWE-201 FIX: Sanitize requestParams, responseContent, and URI ONLY for logging
string sanitizedRequest = SanitizeForLogging(requestParams);
string sanitizedResponse = SanitizeForLogging(responseContent);
string sanitizedUri = SanitizeUriForLogging(request.RequestUri);
string error = $"Error in Api:{sanitizedUri}, HttpStatus:{(int)apiResponse.StatusCode}-{apiResponse.StatusCode}, ResponseContent:{sanitizedResponse}, RequestContent:{sanitizedRequest}";
cEventLog.AppendError(cMessages.enmMessageType.mApiRequest, error, orgCode, GetCurrentMethod().Name);
// Return deserialized error payload if API returns structured error JSON.
var data = JsonConvert.DeserializeObject<T>(responseContent);
return data;
}
}
}
}
}
catch (Exception ex)
{
cEventLog.AppendError(cMessages.enmMessageType.mApiRequest, ex, orgCode, "SendAsyncRequest");
throw;
}
}
.png){kind=logo}
Hello @UPatel007528 (Community Member)
Thanks for your post. Veracode Static Analysis reports on CWE-201 (Insertion of Sensitive Information into Sent Data) whenever it detects that possibly sensitive data is transmitted out of your application. Configuration and/or properties files are often viewed as sensitive data sources by the scanner. The concern is that the sent information could be confidential (like credentials or personal/private communications), or it might give adversaries intelligence for later attacks. This flaw is Low severity as integrity and availability are not a concern, only confidentiality.
Please note the Veracode static analysis engine is unable to introspect the nature of the transmitted data as part of a scan request, this level of detail is not available to the scanner to see. So, the question you need to ask with these flaws in your scan results if whether this data is really sensitive or not. These findings give the opportunity to review the sensitivity.
In the Veracode Platform, within the Triage Flaws view for your scan request, the flaw description will offer more information on why the Static Analysis engine identified the content and location in the code as potentially sending out sensitive data. To see a specific flaw's description, click on the black triangle located at the far left in the Triage Flaws view.
To address this finding, we recommend reviewing whether the transfer of potentially sensitive data identified by the scanner is intentional and compliant with your application security policy. If it is unintentional or breaches your application security policy, stop transmitting that specific data. Otherwise, if there are no sensitive data, or the sensitive data is used correctly and safely, then please propose a mitigation to document the nature of this data, where it originates, and that the transfer of this data is by design.
After entering a mitigation proposal, please work with your organization's internal security team and Veracode administrators to approve the mitigations and resolve these flaws. For more information and guidance on how to enter a mitigation proposal and how this can be used to address static scan results, please consult the following Veracode documentation resources:
I hope this information helps. If you still have any questions, please consider scheduling a consultation call to discuss by following the instructions at https://community.veracode.com/s/article/How-to-schedule-a-consultation-call. There is also a "Schedule Consultation" quick scheduling button right on the Veracode Community Home page you can use.
Best Regards,
Andrew Bell