YG790424 (Community Member) asked a question.
Has anyone in the Dev community worked with Veracode's Custom cleansers ?
https://help.veracode.com/reader/DGHxSJy3Gn3gtuSIN2jkRQ/xrEjru~XmUHpO6~0FSae2Q
We have lot of flaws that we know are false positives. I wanted to know if any one here tried them?
Thanks,
Ask the Community
Get answers, share a use case, discuss your favorite features, or get input from the community.
By clicking “Accept All Cookies”, you agree to the storing of cookies on your device to enhance site navigation, analyze site usage, and assist in our marketing efforts.
.png){kind=logo}
These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the site will not then work. These cookies do not store any personally identifiable information.
These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site. All information these cookies collect is aggregated and therefore anonymous. If you do not allow these cookies we will not know when you have visited our site, and will not be able to monitor its performance.
These cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.
We've used the .NET RedirectUrlCleanserAttribute from the library and it worked.
We found that the stock cleansers in Veracode are web development focused and less C# client/server focused. We've ended up writing our own and using the [FileCleanser] C# Veracode DLL attribute to mark them. Even so we still have to mitigate many as "false positives". Veracode seems not to handle deep stack level tracing well, e.g. this caller used our cleanser method and still flags the "called" method as "insecure".
Hi @Scott J (Community Member) ,
Thank you for your feedback.
If you know of any commonly used cleansing functions I would very much like to request that you propose an idea in the Veracode Community Ideas at https://community.veracode.com/s/ideas , your industry experience is invaluable input for Veracode Program Management.
If you have issues where a [FileCleanser] custom cleanser is correctly operating on the data for the file path and the custom cleanser feature has been enabled by your security team but Veracode Static Analysis is not proposing a mitigation for you I would recommend you contact our technical support team. Here's how you can log a case:
1. Navigate to the upper right corner of any page in the Community, click on your user avatar.
2. Select Contact Support from the drop-down menu.
Please provide a link to the Triage Flaws view with the flaws as well as the flaw ids.
Thank you,
Boy Baukema
Hi @YG790424 (Community Member) ,
Thank you for initiating this discussion, we're looking forward to hear everyones experiences with Custom Cleansers. As a Veracode Application Security Consultant I see many teams use Custom Cleansers. Here are some things that are important to keep in mind when using Veracode Custom Cleansers:
1. Supported Cleansing Functions ( https://help.veracode.com/reader/4EKhlLSMHm5jC8P8j3XccQ/IiF_rOE79ANbwnZwreSPGA ) are preferable. These have been vetted by Veracode Research and will automatically close the flaw.
2. Marking one of your functions as a Custom Cleanser is a good fit if:
A. All data flows through it before reaching the point where the flaw is reported (this typically means the function should be used very close to where the flaw was found).
B. The data is returned from the function (it's not used for a boolean decision).
C. You are actively developing the application. You may not want simply apply mitigations manually for legacy projects.
3. Custom Cleansers have to be enabled by your security team: https://help.veracode.com/reader/RXjxbTR2MDQdN3gX4l53CQ/qBpw6yXOpKGELy9APnDXIA
If you would like advice on flaw remediation or to discuss any potential false positives I recommend you schedule a consultation with a Veracode Application Security Consultant. You can find details on how to schedule a consultation here: https://help.veracode.com/reader/DGHxSJy3Gn3gtuSIN2jkRQ/7YQTCDJKFEQzL3gL_N90hQ.
Thank you,
Boy Baukema