Hello @svenkadachalam184685 (Community Member)​ 

Thanks for your question and all the background detail provided on what you tried up to this point. To answer your question about the "isWithinBaseDir()" custom helper validation method you created and whether the Veracode static analysis engine would recognize that method during a static scan as a fix for CWE-73 -- the answer is no, the Veracode engine is unable to evaluate this custom method during a static scan.

As you've already rightly observed and noted, the static engine does not actually execute the .NET application code while scanning, which would be the only reliable means of confirming this method you've defined does in fact prevent a path traversal external filename control risk here. How Veracode static analysis works is the engine generate a model representation of your source code that you can think of as a graph layout. The engine then traces this static model representation of your code to identify the data paths where external tainted inputs your application accepts can flow and reach certain .NET sink functions to report on a CWE.

Since "isWithinBaseDir" is a custom, bespoke helper method that you created to help mitigate the CWE-73 risk, the engine will not recognize this function as a CWE-73 fix cleanser when it traces the generated model. This is why the finding still gets reported.

At this time, Veracode recommends that you take the following next step which is to submit a "Mitigate by Design" mitigation proposal for the CWE-73 flaw that has this method added and applied as part of the data path. The proposal you enter would then document and describe how this function works to demonstrate how it addresses the risk here.

To learn more about entering a mitigation proposal to resolve flaws the Veracode static engine identifies, please refer to https://docs.veracode.com/r/improve_mitigation and https://docs.veracode.com/r/Video_Mitigate_Static_Analysis_findings . You will need to contact and work with your organization's application security team members responsible for your Veracode usage and administration to apply and complete this process.

Then to answer your next pair of questions inquiring about guidance and best practices that could fix the CWE-73 flaw in a way the static engine would recognize during a re-scan, Veracode recommends that you check out the following Community guide that we have created about this CWE at https://community.veracode.com/s/article/how-do-i-fix-cwe-73-external-control-of-file-name-or-path-in-java. This guide contains all the recommendations and strategies for how you can fix and address this flaw. Each fix strategy shown is presented to show which ones will be recognized by our engine during a static re-scan versus which strategies will require submitting a "Mitigate by Design" mitigation proposal to resolve by completing that workflow.

For example, the "isWithinBaseDir()" method you created is performing a recommended and proper .NET canonical path validation to manage the risk here. You can refer to the "CWE73-C14N" section about applying the canonical path validation for more details about this strategy. Kindly note and observe how this section points out the need for submitting a mitigation proposal to close out the flaw when applying this control.

In short, the only fix our engine would recognize for CWE-73 is if the final filename input value you pass as the input argument to your file operation call is completely hardcoded with no mention of any tainted external values from outside the code. If that is not practical to do with this app's use case as the input is highly dynamic and cannot be anticipated in advance with hardcoded filename values, then please move forward with entering a mitigation proposal as described above.

I hope this information helps. Should you still have any questions or concerns after reading through the Veracode Community CWE-73 guide that was shared, then please follow the instructions that are provided under the section "None of these strategies work for me, what now?" for how to request additional support from Veracode in addressing these flaws. You also may refer to https://docs.veracode.com/r/Schedule_a_consultation and https://docs.veracode.com/r/Video_Schedule_a_consultation for how to request a consultation.

Best Regards,

Andrew