TWilliamson173102 (Community Member) asked a question.
Veracode makes available some annotations which they say will flag custom cleaning solutions so that they are recognized by the Veracode Static Analysis:
https://docs.veracode.com/r/t_annotate_java
I have added these annotations to one of our custom cleansing routines, and have resubmitted the application for a new static analysis:
@XSSCleanser
@RedirectURLCleanser
@FilePathCleanser
@SQLQueryCleanser
@CRLFCleanser
public static void checkUrl( String url ) {
// some code here
url = niceCleanUrl();
}
But the annotations do not appear to affect the output at all. Everywhere that calls checkUrl() is still flagged as a vulnerability.
What am I doing wrong? Or do these annotations even work?
.png){kind=logo}
Hi @TWilliamson173102 (Community Member) ,
Veracode Custom Cleansers are disabled by default by an administrator setting, please contact your the administrator in your organization for the Veracode Platform and ask them to change the setting for Custom Cleansers, you can see the available options here: https://docs.veracode.com/r/c_cleanser_admin
Please also note that, similar to supported cleansers, these functions only work when detected on the datapath, so for example:
@RedirectUrlCleanser
public static void checkUrl(String url) {
//do something
}
Will not do anything, you should implement a function where the data passes through it, like so:
@RedirectUrlCleanser
public static void validateURL(String url) {
String validatedURL = ... do something to url...;
return validatedURL;
}
Thank you,
Boy Baukema