locked
FxCop error: parameter being passed is possible security vulnerability RRS feed

  • Question

  • Hi,
    When I run FxCop, the analysys report lists a critical error. It says:

    "Review the following for a possible security vulnerability: Parameter [parameter name] of [class name] is being passed to a [another class name] constructor"

    What is typically done to address this error? If you're confident that it's not a security vulnerability, should you ignore it? If not, what steps are generally taken to "sanitize" it? Comparing and reassigning, etc?

    Thanks,

    Kim

    Tuesday, June 27, 2006 7:11 PM

Answers

  • Hello Kim,

    Are you seeing a violation when running the Security rule ReviewImperativeSecurity?

    Technically, the rule is analyzing if you are passing a parameter to a method call on IPermission or IStackWalk - e.g. a filename.

    That rule is currently designed as a security auditing assistant, so there isn't a bulletproof way to sanitize/secure the code except to suppress the FxCop violation for this instance. You could copy the parameter to another local, but I honestly wouldn't recommend that [hack], because in the future we may to improve the data flow analysis to recognize that the value has been unchanged since it was passed as a parameter.

    If you have confirmed the code is secure, I would advocate suppressing ONLY this instance of the violation (e.g. leave the rule enable for all other methods/classes).

    Hope that helps,
    Stephen

    Friday, June 30, 2006 12:35 AM

All replies

  • Hello Kim,

    Are you seeing a violation when running the Security rule ReviewImperativeSecurity?

    Technically, the rule is analyzing if you are passing a parameter to a method call on IPermission or IStackWalk - e.g. a filename.

    That rule is currently designed as a security auditing assistant, so there isn't a bulletproof way to sanitize/secure the code except to suppress the FxCop violation for this instance. You could copy the parameter to another local, but I honestly wouldn't recommend that [hack], because in the future we may to improve the data flow analysis to recognize that the value has been unchanged since it was passed as a parameter.

    If you have confirmed the code is secure, I would advocate suppressing ONLY this instance of the violation (e.g. leave the rule enable for all other methods/classes).

    Hope that helps,
    Stephen

    Friday, June 30, 2006 12:35 AM
  • Hi Stephen,

    I'm sorry, I forgot to mention -- yes, it's running the ReviewImperativeSecurity rule. Thanks for the suggestion!

    Kim

    Saturday, July 8, 2006 1:44 AM