Click here to Skip to main content
15,887,676 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
Hi Guys,

I have done the following...

C#
private static IDbConnectionProvider CreateSqlConnectionProvider(DbConfig dbConfig)
{
	return
	new QcDbConnectionProvider(() =>
		{
			SqlConnectionStringBuilder csBuilder = new SqlConnectionStringBuilder();

			if (!string.IsNullOrEmpty(dbConfig.DataSource)) 
				csBuilder.DataSource = dbConfig.DataSource;
		   
			if (!string.IsNullOrEmpty(dbConfig.Database))
				csBuilder.InitialCatalog = dbConfig.Database;
		   
			csBuilder.IntegratedSecurity = dbConfig.IntegratedSecurity > 0;

			if (!string.IsNullOrEmpty(dbConfig.UserId)) 
				csBuilder.UserID = dbConfig.UserId;

			if (dbConfig.EncryptedPassword != null) 
				csBuilder.Password = Encryption.LocalEncryption.DecryptString(dbConfig.EncryptedPassword);
			
			csBuilder.Pooling = false;

			return new SqlConnection(csBuilder.ConnectionString);
		});
}


The client is using VERACODE tool for doing code analysis and the VERACODE has detected a flaw "Untrusted initialization" at

C#
return new SqlConnection(csBuilder.ConnectionString);


Also, the dbConfig is being initialized as shown below...

C#
DbConfig configDbConfig = new DbConfig
{
	Database = codeFile.ConfigurationDb,
	DataSource = codeFile.DataSource,
	IntegratedSecurity = sqlCredentials.UseWindowsAuthentication ? 1 : 0,
	UserId = sqlCredentials.UseWindowsAuthentication ? null : sqlCredentials.SqlUserName,
	ClearTextPassword = sqlCredentials.UseWindowsAuthentication ? null : sqlCredentials.SqlUserPassword
};


What I need to do in order to fix this flaw?
Thanks in advance.
Posted
Comments
virusstorm 12-Jun-15 13:49pm    
I suggest contacting the vendor that makes VERACODE and ask them what it means. It could be a case of a false positive because of the way you are building the connection string.
Nishith Jain 15-Jun-15 2:48am    
Thanks for your suggestion. Will try contacting the VERACODE.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900