ASP.NET Veracode 扫描问题

Question

我们的客户端使用 Veracode 扫描工具扫描 ASP.NET 应用程序。除了以下问题，我们已经解决了许多缺陷。

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')
(CWE ID 113)(1 flaw) in the line  

HttpContext.Current.Response.AddHeader("Content-Disposition", contentDisposition);

这是对应的代码:

public static void DownloadFile(string fileName, byte[] dByteData, bool isNoOpen = false)
        {

            byte[] fileContents = new byte[] { };
            string contentDisposition = string.Empty;
            fileContents = dByteData;
            if (string.IsNullOrWhiteSpace(fileName))
            {
                return;
            }
            fileName = fileName.Replace("\n", "").Replace("\r", "");
            string contentType = "application/*.".Replace("\n", "").Replace("\r", "");
            contentDisposition = "attachment; filename=\"" + HttpContext.Current.Server.UrlPathEncode(fileName) + "\"";//While Downloading file - file name comes with junk characters
            contentDisposition= contentDisposition.Replace("\n", "").Replace("\r", "");
            HttpContext.Current.Response.Buffer = true;
            HttpContext.Current.Response.Clear();
            HttpContext.Current.Response.ClearContent();
            HttpContext.Current.Response.ClearHeaders();
            HttpContext.Current.Response.Charset = "";
            HttpContext.Current.Response.ContentType = contentType;
            if (isNoOpen)
            {
                HttpContext.Current.Response.AddHeader("X-Download-Options", "noopen");
            }
            HttpContext.Current.Response.AddHeader("Content-Disposition", contentDisposition);
            HttpContext.Current.Response.AddHeader("Content-Length", fileContents.Length.ToString());
            HttpContext.Current.Response.BinaryWrite(fileContents.ToArray());

            HttpContext.Current.Response.End();
            HttpContext.Current.Response.Flush();
            HttpContext.Current.ApplicationInstance.CompleteRequest();
        }

文件名或路径的外部控制(CWE ID 73)

if (File.Exists(filePath))
            {
                File.Delete(filePath);
            }

它在 File.Delete 中显示错误线。我们已经尝试清理文件路径并使用 Path.GetFullpath但徒劳而已。

Answer 1

您可以通过调用堆栈分析获得有关缺陷来源的更多详细信息(可在 Veracode 分析中心的应用程序构建扫描结果的分类缺陷部分找到)。如果没有这些信息，一些 Veracode 缺陷的来源很难理解。