Develop Reference

CWE 73 Error - Veracode Issue -.net application

I have been problem to solve an appointment of Veracode Scanner in my project. I created a function to validate a file but it did not pass in veracode scanner;
Here is the code of my function:
public static string GetSafeFileName(string fileNameToValidate)
{
fileNameToValidate= fileNameToValidate.Replace("'", "''").Replace(#"../", "").Replace(#"..\", "");
char[] blackListChars = System.IO.Path.GetInvalidPathChars();
char[] blackListFilename = System.IO.Path.GetInvalidFileNameChars();
foreach (var invalidChar in blackListChars)
{
if (fileNameToValidate.Contains(invalidChar))
{
fileNameToValidate = fileNameToValidate.Replace(invalidChar, ' ').Trim();
}
}
string fullPath = Path.GetFullPath(fileNameToValidate);
string directoryName = Path.GetDirectoryName(fullPath);
string fileName = Path.GetFileName(fullPath);
foreach (var invalidChar in blackListFilename)
{
if (fileName.Contains(invalidChar))
{
fileName = fileName.Replace(invalidChar, ' ').Trim();
}
}
string finalPath = Path.Combine(directoryName, fileName);
return finalPath;
}
What are the changes i have to fix the cwe 73 appointment in Veracode scanner? Anybody can help me?
My project is a windows forms running on .net 4.0
Thanks,
Bruno

Your problem is that Veracode doesn't actually detect what your code is doing, it detects what cleanser function is (or is not) being called. If you login to Veracode and search for help on "Supported Cleansing Functions" you'll find the list that are detected in your language.
Unfortunately, the list for .Net doesn't include anything for a CWE-73.
So, your solution is to specifically label your function as a cleanser for CWE-73 using a custom cleanser annotation. Search Veracode help for "Annotating Custom Cleansers".
using Veracode.Attributes;
[FilePathCleanser]
public static string GetSafeFileName(string fileNameToValidate)
{
...
That said, your implementation is not secure. Try passing in "C:\Windows\System32\notepad.exe" as a filename to be written to and you'll see the problem.
Blacklisting can only deal with what you expect. Whitelisting is a much stronger approach. Your approach should be based on a whitelist of directories, a whitelist of characters for filenames, and a whitelist of file extensions.

I have tried to solve similar problem but in java context. We used ESAPI as external library. You can review esapi project (for ideas how to realise a better solution in your project):https://github.com/ESAPI/esapi-java-legacy
Actually using esapi validator didn't solve the problem with veracode, but in my opinion reduce the risk for attack. With such a library you can enshure that user can't read file out of parent folder(you must hardcode such a directory) and that the user can't read a file with unproper extension -> you can add such a list with file extensions. But this library cant garantee that you can't manipulate files in the parent directory with allowed extensions.
So if you think that all needed verifications of filepaths are done you must ask for mitigation by design or develope a Map with all needed file resources in the project to enshure that there is no way the user to manipulate external files.
Also if you think that you have created a good filepath verification you can use cleanser annotation to mark your method. Here you can read more about custom cleansers
https://help.veracode.com/reader/DGHxSJy3Gn3gtuSIN2jkRQ/xrEjru~XmUHpO6~0FSae2Q

Calling a Python script from C# - changing the script's filepath causes the program to not work

The following code works perfectly without flaw:
public partial class MainForm : Form
{
string pyInterp = File.ReadAllText(Directory.GetCurrentDirectory() + #"\config\pathToPythonInterpreter.txt");
string pyWeather = #"C:\getWeather.py";
public MainForm()
{
InitializeComponent();
UpdateWeather();
}
public void UpdateWeather()
{
labelWeather.Text = PySharp.ExecutePy(pyInterp, pyWeather);
}
}
However, when I change the path to getWeather.py to not be in an arbitrary random location, like this:
string pyWeather = Directory.GetCurrentDirectory() + #"\scripts\getWeather.py";
Then my program no longer obtains the script's output. The script still works: I launched it using IDLE and it completed its function properly. When I call it using C#, the console opens, yet no output is obtained.
The Python script is the following:
from requests import get
from bs4 import BeautifulSoup as soup
r = get("http://www.ilmateenistus.ee/ilm/prognoosid/4-oopaeva-prognoos/")
parsed = soup(r.content, "html.parser")
container = parsed.find("div",{"class":"point kuusiku"})
print(str(container["data-title"]))
(It webscrapes my local weather)
PySharp.ExecutePy() can be viewed here
By far the strangest bug I've ever encountered. Any ideas?
EDIT 1: It seems that C# is indeed reading something from the script. It just appears that this something is.. nothing. I gave the label a default sample text, and after running the program, the label's text is simply changed to an empty string. Hope this incredible discovery helps somehow.
EDIT 2: The program fails to call the script correctly when its filepath contains spaces. For example:
C:\foo bar\testing\pyWeather.py
does not work!

Try surrounding the path that contains spaces with 2 double quotes.
For e.g.
string pyWeather = #"""C:\Users\[myname]\Documents\Visual Studio 2017\Projects\testing\testing\scripts\getWeather.py""";
Similarly, you can do string pyWeather = Directory.GetCurrentDirectory() + #"\scripts\getWeather.py"; followed by pyWeather = "\"" + pyWeather + "\"";.

I would want you to return the answer instead of printing. Printer is an I/O based solution to display. So it will work super fine with IDLE however it may not return results as you expected. I strongly believe this will solve your problem.
instead of printing please try return. I can give more support after trying this.
return(str(container["data-title"]))

MSDN OneNote Api: Navigate to never before opened page without opening a OneNote Application Window

My goal is to be able to use C# to programmatically open any .one section file and get all of the section's page ids. In a simple case (one where I have created and recently used the section), this can done with the following code:
using Microsoft.Office.Interop.OneNote;
class Program
{
public static void ProcessOnenoteFile()
{
Application onenoteApp = new Application();
string filepath = #"C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\testsection.one";
string sectionId;
onenoteApp.OpenHierarchy(filepath, null, out sectionId);
string hierarchy;
onenoteApp.GetHierarchy(sectionId, HierarchyScope.hsPages, out hierarchy);
File.WriteAllText(#"C:\hierarchy.txt", hierarchy);
}
}
From here I can parse the xml to find all the pageIds and I am good to go.
The problem, however, is that I want to do this with files I am getting from somebody else and have never opened before. When I run the same code on those files, I cannot find any pageIds in the hierarchy, and therefore, I cannot process any pages. A fix that seems to work is to use the navigateTo method to open the section file in OneNote before trying to get the hierarchy.
...
string sectionId;
onenoteApp.OpenHierarchy(filepath, null, out sectionId);
onenoteApp.NavigateTo(sectionId);
string hierarchy
...
This, however, is quite annoying as I need to open the OneNote application. Since I have many .one section files to process it would be a lot of random information flashing across the screen which is not necessary and might confuse the end users of my program. Is there a way I can achieve the same result of adding pageIds to the hierarchy without needing to open the OneNote Application? At the very least, is there a way I can hide the application?
UPDATE:
I just noticed that using the Publish command also updates the hierarchy with pageIds, however, this solution is still not ideal as it requires me to make anotehr file.
Also, looking more closely at the xml export, I saw that there is a an attribute called "areAllPagesAvailable" which is set to false for me on all the files I have yet to open in OneNote.

WooHoo! After a couple hours of just playing around and Google Searching the different methods, I have found what I am after.
Solution: SyncHierarchy(sectionId);
...
string sectionId;
onenoteApp.OpenHierarchy(onenoteFile, null, out sectionId, CreateFileType.cftSection);
onenoteApp.SyncHierarchy(sectionId);
string hierarchy;
onenoteApp.GetHierarchy(sectionId, HierarchyScope.hsPages, out hierarchy);
...

Check if ASP.NET WebForms page exists based upon relative URL provided in Query String

Given a query string url of the form "~/folder/page.aspx", is there a way to check if that page exists within the scope of the application?
I'm in a situation where I'm fixing a minor bug where, if a user attempts to log in to the application from a set of publicly accessible application error pages, then they're redirected back to that public error page. I've been asked to have the user be redirected to the main home page if they're logging in to the application from this state.
So far I've fixed the issue by hard coding the paths to the affected pages in a switch statement, checking the querystring against the hardcoded paths. I feel this is hacky and bad, and would love a more dynamic solution, but I can't seem to find one.
Any help would be greatly appreciated.
Edit - Specifically, my preferred solution would simply be to check that the path defined by the query string url (without a priori knowledge of the exact format) leads to a specified folder within the scope of the application.

So, after looking some more, I discovered Server.MapPath. I can use this in conjunction with System.IO.Directory to see if the file is contained within the directory.
string targetUrl = Request.QueryString["redirect"];
string serverUrlPath = Server.MapPath(targetUrl);
string serverDirPath = Server.MapPath("~/ErrorPages");
foreach (string file in Directory.EnumerateFiles(serverDirPath))
{
if (file.Equals(serverUrlPath, StringComparison.OrdinalIgnoreCase))
{
Response.Redirect(Master.ProjectSearchRedirect());
}
}
Response.Redirect(targetUrl);
I was hoping for something a little more refined (even just a Directory.Contains kind of encapsulation).

C# - MessageBox - Message localization in resources and lines breaks

I would like to show MessageBox (WinForms) with string from Resources with lines breaks.
example without Resources (WORKS):
string someMsg = "Message. Details:\n" + someDetails;
MessageBox.Show(someMsg);
Result:
Message. Details:
here are some details
When I move string "Message. Details:\n" into Resources:
string someMsg = GlobalStrings.MsgBoxJustTest + someDetails;
MessageBox.Show(someMsg);
Result:
Message. Details:\nhere are some details
When I moved string with "\n" to resources then MessageBox.Show() stopped to interpret it as newline.
Edit: I'm thinking about: someMsg.Replace(#'\n',Environment.NewLine);
but it's still quite annoying for so simple thing.

if you add that to resources it doesn't take \n as escape charecter
Just open your resource file in notepad to see this and cahnge in XML file(resx)
or
Type your data in notepad with new line.
Copy that and paste in your resource editor
edit:
or
Type/Paste your data into the resource editor UI, select the \n and replace it with an actual linebreak, with Shift-Enter.

You could do something like this (as long as your not .net 2.0):
public static class StringExt
{
public static String FixNewLines(this String str)
{
return str.Replace(#'\n',Environment.NewLine);
}
}
And then:
string someMsg = GlobalStrings.MsgBoxJustTest + someDetails;
MessageBox.Show(someMsg.FixNewLines());
However, this will affect ALL strings in your application (namespace scope)
It's a dirty fix, but it's a quick fix.
Personally, I would just fix my logic all the way through, rather than do something like the above.

Maybe you can Open the resx file as code and add the line breaks directly in the
XML
OR
Possibly they get lost when reading due to escape character maybe try using \\

One easy solution is to store “placeholders” in a resource strings. For instane, this string is stored in *.resx under “MessageDetails” key: "Message. Details:{0}{1}". Then, in your code, use it like this:
MessageBox.Show(String.Format(GlobalStrings.MessageDetails, Environment.NewLine, #"The message"));
The advantage here is a portability, as you can see.