How To Use Custom Cleanser
How to Use the Custom Cleanser
The Veracode Static Analysis tool supports a number of cleansers across many languages to remediate certain CWEs. You can find the full list of supported cleansing functions in our Help Center: https://docs.veracode.com/r/review_cleansers . While this can be helpful for the handful of CWEs that are supported, there are some common CWEs that have no industry-known cleansers because there's no silver bullet that would address every type of implementation. For this situation, Veracode offers a custom cleanser feature that allows you to specify your own cleansing method.
The custom cleanser feature allows your development team to designate a specific method with Veracode annotations so that it can be recognized by the Veracode Platform to provide an easy mechanism to auto-mitigate flaws. This can save you significant time by not having to triage flaws in your scan that you know have been mitigated by your own custom cleanser. The custom cleanser feature has annotations available for these sets of Flaw Classes: CRLF Injection, File Path Injection, Open Redirect, SQL Injection, and Cross-Site Scripting (XSS). Currently, the custom cleanser feature is only supported for Java and .NET. You can find the full details on the feature in the Veracode Help Center: https://docs.veracode.com/r/customcleansers.
WARNING - Before allowing the usage of the custom cleanser feature it is highly advised that the cleanser method be vetted by your security team. Veracode does not assess the annotated method for validity or ensure that all usage is done properly. Like with any code, the development team should unit test their application to ensure the application still functions properly and still mitigates the security risk.
Getting started
Enabling the feature:
To get started with custom cleansers, you must first have the feature enabled on your account. The request should be made by your Security Lead or Veracode Administrator. This can be done by emailing Support@veracode.com or reaching out to your Veracode Security Program Manager.
Once the custom cleanser feature is enabled, the Security Lead or Veracode Administrator will need to decide on what should happen when the Veracode Platform sees a Veracode Annotation within your application scan. Here are the 3 possible options:
- None - This is the default setting when the feature is enabled by Veracode. The Veracode Platform will do nothing if it sees a Veracode Annotation in your code.
- Propose - This is the most common option among our customer base. The Veracode Platform will auto-propose a mitigation for the flaw class reported by the Veracode Static Analysis Tool. The flaw reported will have a mitigation status of propose and if you expand on the flaw details, you will see "Proposed by Custom Cleanser Function" with comments stating cleansing method with the Veracode Annotation.
- Approve - This is not recommended and should be carefully discussed/reviewed before enabling. The Veracode Platform will auto-propose a mitigation as well as auto-approve the mitigation for the flaw class reported by the Veracode Static Analysis Tool without any review or acknowledgement of the mitigating controls.
https://docs.veracode.com/r/c_cleanser_admin
Download the Veracode Annotations library:
Before you can start writing your own cleanser, you'll want to download the Veracode Annotations library.
Java:
You can download the Veracode Annotation JAR from Veracode or Maven Central:
You can download the Veracode Annotation JAR from Veracode or Maven Central:
- https://tools.veracode.com/customcleanser/VeracodeAnnotations.jar
- https://repo1.maven.org/maven2/com/veracode/annotation/VeracodeAnnotations
Or you can add it as a dependency in your pom.xml to pull into your project:
<dependency>
<groupId>com.veracode.annotation</groupId>
<artifactId>VeracodeAnnotations</artifactId>
<version>[1.0.4,)</version>
</dependency>
.NET:
You can download the Veracode Annotation DLL from Veracode or NuGet:
<dependency>
<groupId>com.veracode.annotation</groupId>
<artifactId>VeracodeAnnotations</artifactId>
<version>[1.0.4,)</version>
</dependency>
.NET:
You can download the Veracode Annotation DLL from Veracode or NuGet:
- https://tools.veracode.com/customcleanser/VeracodeAttributes.dll
- https://www.nuget.org/packages/VeracodeAttributes
See the Veracode Help Center for additional information: https://docs.veracode.com/r/customcleansers
Implementing the custom cleanser feature
Now that you understand what the custom cleanser is and you have downloaded the Veracode Annotation library to your project, you can start leveraging the feature.Below is a code example usage of the FilePathCleanser annotation to address CWE 73. In Traversal.java, I have made a call to SecurityUtil.validateFile() which is the method that has been annotated with FilePathCleanser. Currently the cleansing function does nothing but it will be seen by the Veracode Platform and take the appropriate action as defined in the Custom Cleanser Administration setting. This goes back to my earlier caution that developers should not given free reign on using this feature without some input or vetting by the security team. I recommend leveraging the solution as mentioned in this Community article to insert into your cleansing function: https://community.veracode.com/s/article/how-do-i-fix-cwe-73-external-control-of-file-name-or-path-in-java. Also, I choose FilePathCleanser annotation specifically for this example as it is the only annotation I really recommend using; other flaw categories have been known to widely use cleansers or have standard solutions and best practices to prevent security flaws.
Also notice that the custom cleanser feature allows for providing a userComment string to be added to the flaw as well. The userComment string is not required.
Traversal.java
public static void safeRead(String file) throws Exception{
String safeFile = SecurityUtil.validateFile(file);
FileReader fr = new FileReader(safeFile);
int i;
while((i = fr.read()) != -1){
FileReader fr = new FileReader(safeFile);
int i;
while((i = fr.read()) != -1){
System.out.print((char)i);
}
fr.close();
}fr.close();
SecurityUtil.java
@FilePathCleanser(userComment = "Mitigated by validateFile() in SecurityUtils")
public static String validateFile(String file) {
//FilePath Validation
return file;
}
Here is what the mitigation for the flaw looks like on the Veracode Platform:
.png){kind=logo}
