Replies: 1 comment
-
I think we should validate the file path used inside V1Save method using some regular expressions like @"^[a-zA-Z]:\(((?![<>:""/\|?]).)+((?<![.])\)?)$" Veracode treat this as a security vulnerability since someone outside can manipulate the file path |
Beta Was this translation helpful? Give feedback.
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
-
Veracode source code security analyzer tool is giving External Control of File Name or Path (CWE ID 73) error, below are the error details.
Module: microsoft.win32.taskscheduler.dll
Location: void V1Save(string)
**Error Description: **
This call contains a path manipulation flaw. The argument to the function is a filename constructed using untrusted
input. If an attacker is allowed to specify all or part of the filename, it may be possible to gain unauthorized access to
files on the server,
Recommendations
Validate all untrusted input to ensure that it conforms to the expected format.
Could you please fix above security issue
Beta Was this translation helpful? Give feedback.
All reactions