AShivhare113063 (Community Member) asked a question.
Hi,
In my application we extensively use ngb-modal from
import { NgbModal, NgbModalOptions } from '@ng-bootstrap/ng-bootstrap';
Syntax:
@ViewChild('hideModal') hideModal: ElementRef
this.modalService.open(this.hideModal, options);
Veracode shows this as External Control of File Name or Path (CWE ID 73) error, any thoughts on how to fix this ?
Hi @AShivhare113063 (Community Member)
Based on the documentation for ngbModal .open() helps only open new Modal windows. We see the 'this.hideModal' is passed as the content parameter which refer to the existing already referenced modal.
(Refer: https://ng-bootstrap.github.io/#/components/modal/api#NgbModal)
The options argument only explains how a new modal properties such animation, backdrop and other attributes. We do not see the possibility of referencing a file object. Thus by looking at limited code available in the question, we see this flag a potential false positive, as CWE 73 only concerns Filename or Paths. None of them are used here by the code.
(Refer: https://ng-bootstrap.github.io/#/components/modal/api#NgbModalOptions)
If you have any questions on this I would recommend scheduling a Consultation with a Veracode Application Security Consultant. You can find more on how to do this here: https://help.veracode.com/r/t_schedule_consultation.
Regards,
Kashif
.png){kind=logo}
Hi @AShivhare113063 (Community Member)
Based on the documentation for ngbModal .open() helps only open new Modal windows. We see the 'this.hideModal' is passed as the content parameter which refer to the existing already referenced modal.
(Refer: https://ng-bootstrap.github.io/#/components/modal/api#NgbModal)
The options argument only explains how a new modal properties such animation, backdrop and other attributes. We do not see the possibility of referencing a file object. Thus by looking at limited code available in the question, we see this flag a potential false positive, as CWE 73 only concerns Filename or Paths. None of them are used here by the code.
(Refer: https://ng-bootstrap.github.io/#/components/modal/api#NgbModalOptions)
If you have any questions on this I would recommend scheduling a Consultation with a Veracode Application Security Consultant. You can find more on how to do this here: https://help.veracode.com/r/t_schedule_consultation.
Regards,
Kashif